CVE-2026-72718 in goose
Summary
by MITRE • 08/10/2026
goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose `.git/config` sets [`core] fsmonitor = <command>` causes Git to execute that command on the host during the index refresh performed by `git diff HEAD`. The command runs before goose contacts a model and without a submitted prompt, model call, tool approval, or trust prompt. The context-gathering Git process is not sandboxed and is outside goose's tool-permission model. Arbitrary commands run with the privileges and environment of the user running goose, allowing file access or modification and exfiltration of environment secrets and provider API keys. The vulnerable Git invocations are built by git_command() in crates/goose-cli/src/commands/review/handler.rs and are used by touched_files() and collect_diff() for `git diff --name-only HEAD` and `git diff HEAD`. This issue is fixed in version 1.44.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability described affects goose, a general-purpose AI agent designed to operate locally on user machines. This security flaw exists in versions prior to 1.44.0 and specifically targets the `goose review` command functionality. The core issue stems from how goose handles Git repository interactions during code review processes, creating a dangerous execution environment where attacker-controlled commands can be executed without proper sanitization or user consent.
The technical implementation of this vulnerability involves the `goose review` command invoking the system Git executable to gather diff information for review purposes. However, the command fails to strip or sanitize attacker-controlled Git configuration parameters from the repository's `.git/config` file. When a malicious repository contains a `core.fsmonitor = <command>` directive within its configuration, Git executes this specified command during the index refresh process that occurs automatically when `git diff HEAD` is invoked. This execution happens outside of goose's normal security boundaries and tool permission model, creating an arbitrary code execution vector that operates with the full privileges and environment context of the user running goose.
The operational impact of this vulnerability is significant as it allows for complete system compromise through a simple repository interaction. The command execution occurs before any model communication takes place, meaning there are no prompts for model calls, tool approvals, or trust confirmations present during the vulnerable process. This timing makes the attack invisible to typical user security awareness measures and bypasses goose's normal permission controls. The arbitrary commands execute with the user's privileges, potentially enabling attackers to access sensitive files, modify system resources, exfiltrate environment secrets, and extract API keys that may be present in the user's environment.
The vulnerability manifests through specific Git command invocations constructed by the git_command() function located in crates/goose-cli/src/commands/review/handler.rs. These commands are utilized by both touched_files() and collect_diff() functions to perform `git diff --name-only HEAD` and `git diff HEAD` operations respectively. The lack of input sanitization and proper environment isolation creates a direct path for command injection attacks where any arbitrary command specified in the repository's Git configuration can be executed on the host system. This issue represents a clear violation of secure coding practices and demonstrates the importance of proper input validation and privilege separation in security-critical applications.
This vulnerability maps directly to CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-94 (Improper Control of Generation of Code), as it allows for arbitrary command execution through untrusted input from Git configuration files. The attack pattern aligns with ATT&CK technique T1059.001 (Command and Scripting Interpreter: PowerShell) and T1203 (Exploitation for Client Execution) where an attacker leverages legitimate system tools to execute malicious code. The fix implemented in version 1.44.0 addresses this by properly sanitizing Git configuration parameters and ensuring that the vulnerable command execution occurs within appropriate security boundaries.
Security best practices for preventing such vulnerabilities include implementing proper input sanitization, using secure command execution patterns that avoid shell interpretation of untrusted data, employing sandboxing techniques for external process invocations, and maintaining strict privilege separation between user contexts and system operations. Organizations should also implement regular security reviews of third-party dependencies and ensure that automated tools performing system interactions follow least-privilege principles to minimize potential impact from similar vulnerabilities in the future.