CVE-2026-111079 in Goose
Summary
by MITRE • 10/22/2026
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Goose represents a critical failure in data handling practices within its terminal integration feature, specifically concerning the transmission of shell command history to external Large Language Model endpoints. When this functionality is enabled, the application operates by capturing the raw text output from user terminals and forwarding it directly to configured LLM providers without performing any sanitization or redaction processes. This architectural decision creates a direct pathway for sensitive information to leave the local environment and enter third-party systems, bypassing standard security controls that are typically expected in secure software design. The core technical flaw lies in the absence of input validation and output filtering mechanisms before data crosses trust boundaries, effectively treating all terminal content as benign query context rather than potentially confidential operational data.
From a technical perspective, this behavior constitutes an insecure direct object reference combined with improper neutralization of special elements, leading to unauthorized information exposure. The application fails to distinguish between public command history and private secrets embedded within those commands. In modern development workflows, developers frequently utilize terminal sessions for tasks involving authentication tokens, database passwords, API keys, and other environment variables containing credentials. By transmitting these strings verbatim, Goose exposes them to the LLM provider's infrastructure, where they may be stored in logs, used for model training if permitted by the provider's terms of service, or accessed through compromised administrative interfaces at the vendor side. This lack of data minimization violates fundamental privacy principles and security best practices regarding credential management.
The operational impact of this vulnerability is severe, primarily resulting in sensitive information disclosure that can lead to broader system compromise. If an attacker gains access to logs associated with the LLM provider or intercepts traffic during transmission due to misconfigured TLS settings, they could harvest valid credentials embedded in past commands. These stolen secrets can then be used for unauthorized access to cloud services, internal networks, or third-party APIs that rely on the same authentication mechanisms. Furthermore, because shell history often contains a chronological record of administrative actions and configuration changes, its exposure provides attackers with valuable intelligence about the target environment's architecture, security posture, and operational procedures, facilitating more sophisticated targeted attacks such as privilege escalation or lateral movement within an organization’s infrastructure.
This vulnerability aligns closely with CWE-209, which describes the generation of error messages containing sensitive information, although in this case, it extends to general data leakage rather than just error outputs. It also maps to ATT&CK technique T1530, Data from Local System, where adversaries collect data stored on local systems for exfiltration. Although the initial collection is performed by the application itself rather than a malicious actor, the effect mirrors unauthorized data staging and exfiltration patterns observed in advanced persistent threats. The risk is exacerbated by the fact that LLM providers often retain conversation history to improve their models or for compliance auditing purposes, meaning sensitive credentials may persist indefinitely outside the organization's control perimeter.
To mitigate this vulnerability, immediate remediation should focus on implementing robust data sanitization layers before any terminal output is transmitted to external APIs. Developers must integrate regular expression-based filters or dedicated secret detection libraries that identify patterns resembling API keys, passwords, and tokens, replacing them with masked placeholders such as asterisks or generic identifiers prior to transmission. Additionally, the application should enforce strict input validation to ensure only non-sensitive command text is processed for LLM queries. Users can temporarily disable the terminal integration feature until a patched version is released, thereby preventing further exposure of shell history. Long-term solutions involve adopting a zero-trust architecture where no data leaves the local environment without explicit user consent and thorough security scanning, ensuring that sensitive operational metadata remains confined within trusted boundaries while still allowing for beneficial AI-assisted development workflows through secure, isolated processing environments.