The Gemini CLI had a massive vulnerability around allowlisted commands.

The allowlist matching performed inadequate parsing.

It extracted only the 'root command' without validating subsequent commands in pipelines or command chains.