gemini-bridge MCP Server Arbitrary File Read via Unsanitized Path in consult_gemini_with_files

Technical Analysis

The vulnerable code path accepted a caller-supplied 'files' argument without validating or confining it to an expected working directory, enabling classic path traversal / arbitrary file read (e.g., /etc/passwd, SSH keys, config files with secrets). Because the tool also forwards a caller-controlled 'query' alongside file contents to the Gemini CLI, an attacker-controlled agent or malicious prompt could instruct the tool to read sensitive files and have their contents echoed back in the Gemini response, crossing the trust boundary between the local MCP server, the AI agent, and an external cloud API. This effectively turns a legitimate developer-facing tool into a data exfiltration primitive: any agent or user with access to invoke this MCP tool gains read access to arbitrary files reachable by the server process, and that data leaves the local environment via the Gemini network round-trip. The attack requires no special privileges beyond normal tool invocation, making it exploitable by a compromised or malicious upstream agent, a prompt-injected LLM session, or a careless integration that passes untrusted file paths through.

Affected Systems

gemini-bridge; protocols: MCP

Detection Signatures

• Tool calls to consult_gemini_with_files with 'files' arguments containing path traversal sequences (../, absolute paths outside project root, e.g. /etc/, ~/.ssh/, C:\Users\)
• MCP server logs showing file reads outside the configured working directory
• Unexpected outbound requests to Gemini API immediately following file-argument tool calls with sensitive file paths
• Agent or LLM-generated queries requesting to 'read', 'include', or 'attach' system files not part of the project

Remediation Steps

1. 1

   Upgrade gemini-bridge

   Update to version 1.3.1 or later, which fixes the path confinement issue in consult_gemini_with_files.

2. 2

   Enforce path canonicalization and allowlisting

   Ensure any MCP tool accepting file paths resolves and validates them against an allowlisted base directory before reading, rejecting absolute paths and traversal sequences.

3. 3

   Restrict tool exposure

   Limit which agents/users can invoke file-reading MCP tools, and audit which directories the MCP server process has read access to (principle of least privilege).

4. 4

   Monitor outbound data flows

   Log and review file contents sent to third-party LLM APIs (e.g., Gemini) via MCP tools to detect potential sensitive data exfiltration.