Gemini Image Gen

• Analyzed: May 12, 2026, 3:23 AM
• Findings: 1
• Version: 1.3.1
• Hash: b427186be8c7b93c763a325b254ac009daae87a2ea225e4098b4632ed34735ee
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `scripts/gen.py` file contains a data exfiltration vulnerability. The `--edit` argument, intended for image editing, allows reading arbitrary files from the local filesystem via `load_image_as_base64`. The base64-encoded content of these files is then sent to the Google Gemini API (generativelanguage.googleapis.com) as part of the image editing request. This flaw could be exploited by a malicious prompt to exfiltrate sensitive local files to a third-party service.