google-gemini / google-gemini/gemini-cli
Infinite Loop Vulnerability in Event-Driven Agent State Transition
- Dominant language
- TypeScript
- Stars
- 107k
- Forks
- 14.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 45
Description
### Description
The client loop explicitly tracks a `MAX_TURNS` to prevent infinite loops when the `nextSpeaker` continuously returns the `model` without pausing for user input. However, this simplistic integer-based limit fails to protect against infinite loops caused by zero-latency event flooding in the async event queue.
**Location**: [packages/core/src/core/client.test.ts#L1305](https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/core/client.test.ts#L1305)
### Why it's important
If the framework is unable to trigger the limit fast enough, the event loop spins endlessly, freezing the terminal and pegging the CPU at 100%. A robust token-budget or real-world time-budget failsafe must be implemented directly in the core execution loop rather than just arbitrary turn-counting.
Contributor guide
Research direction
Start by reading packages/core/src/core/client.test.ts around line 1305 and trace the core execution loop it exercises. Reproduce the zero-latency async event flooding described in the issue, then define and test a failsafe that bounds execution without relying only on MAX_TURNS. Done means the loop terminates or pauses instead of freezing the terminal and saturating the CPU.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- ai, cli
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100