CVE-2026-72718

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the "goose review" command runs the system "git" executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose ".git/config" sets "core fsmonitor = " caus...