GHSA-c5px-58j2-7fqp gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

• PyPI gemini-bridge: >= 1.0.0, < 1.3.1 → fixed in 1.3.1

Summary `consult_gemini_with_files` in inline mode read any file path supplied in the `files` argument without confining it to the working `directory`, then forwarded the contents to the Gemini CLI. Because the caller also controls `query`, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. Impact An MCP client — or an LLM that has been prompt-injected into calling the tool — can read any file the server process can access (SSH keys, cloud credentials, `.env`, source) and have it disclosed via the tool response. No code execution by itself. Affected component • Tool: `consult_gemini_with_files(query, directory, files, …)`, `mode="inline"` • Sink: `_read_file_for_inline` via `_prepare_inline_payload` in `src/mcp_server.py` • The `at_command` mode already confined paths; inline mode did not. Root cause `_resolve_path` returned an out-of-root path while only nullifying the *display* name, and `_prepare_inline_payload` read the file regardless. Absolute paths, `..` traversal, and symlink escapes were all accepted. Patch Fixed in 1.3.1. `_resolve_path` now resolves symlinks and confines via `Path.relative_to(root)`; inline mode skips any entry that resolves outside the working directory (the same guard `at_command` already enforced). Workarounds Upgrade to 1.3.1. Before upgrading, avoid `mode="inline"` with untrusted `files` input, or run the server with a restricted-permission user. Credit Reported privately by Zhihao Zhang (WPI).