Rules / CFG061
CFG061 Gemini CLI sandbox weakened (tools.sandbox*)
Severity: error (broad sandboxAllowedPaths) · warn (sandboxNetworkAccess)
OWASP: LLM03:2026 – Excessive Agency
What cfgaudit checks
Gemini CLI runs tools in a sandbox; two settings.json fields can weaken it (the Gemini analog of CFG022):
| Field | Risk | Severity |
|---|---|---|
tools.sandboxAllowedPaths containing /, ~, $HOME, .. (or /*, ~/*, ../…) |
exposes the filesystem root / home directory to sandboxed tools — path isolation is gone | error |
tools.sandboxNetworkAccess: true |
sandboxed tools get unrestricted network egress — an exfiltration / SSRF channel | warn |
cfgaudit checks .gemini/settings.json (project) and ~/.gemini/settings.json (with --user).
Trigger example
{ "tools": { "sandboxAllowedPaths": ["/"], "sandboxNetworkAccess": true } }
→ error (root path) + warn (network access).
Safe alternative
Scope the allow-list to the directories the tools actually need, and leave the sandbox network-isolated:
{ "tools": { "sandboxAllowedPaths": ["./build", "./.cache"], "sandboxNetworkAccess": false } }
References
- CFG022 (Claude Code
sandboxweakening) — the equivalent rule for Claude Code - Gemini CLI settings docs
Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation