A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC.
No further fix actions are needed. Google Cloud Platform implemented a fix to return an error message when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Other use cases are unaffected.
References
| Link | Resource |
|---|---|
| https://cloud.google.com/vertex-ai/generative-ai/docs/security-bulletins#gcp-2024-063 | Vendor Advisory |
Configurations
History
23 Jul 2025, 20:13
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:google:vertex_gemini_api:-:*:*:*:*:*:*:* | |
| First Time |
Google vertex Gemini Api
|
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | () https://cloud.google.com/vertex-ai/generative-ai/docs/security-bulletins#gcp-2024-063 - Vendor Advisory |
10 Dec 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-12-10 15:15
Updated : 2025-07-23 20:13
NVD link : CVE-2024-12236
Mitre link : CVE-2024-12236
JSON object : View
Products Affected
- vertex_gemini_api
CWE
No CWE.