Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets

Two vulnerabilities – one in Gemini CLI and another in Claude Code – have been discovered that allowed unprivileged attackers to execute code on CI runners, potentially exposing sensitive information. Gemini CLI allowed command injection, while Claude Code exploited a public download counter to leak API keys. Both have…