CVE-2026-129128

The Goose CLI (versions 1.35.0 before 1.53.0) is vulnerable to local code execution via the goose review command. The root cause is the improper handling of the diff.external setting in a repository's .git/config file. An attacker can provide a crafted repository that, when reviewed by a victim, ...

EUVD-2026-125551

Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by setting diff.external in a repository's .git/config. Attackers can ship a crafted repository that, when the victim runs goose review, executes git diff without --no-ext-diff,...

PT-2026-146986

Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by setting diff.external in a repository's .git/config. Attackers can ship a crafted repository that, when the victim runs goose review, executes git diff without --no-ext-diff,...

CVE-2026-72718 goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets core fsmonitor = causes Git to...