CVE-2026-72718

A flaw was found in goose, a general-purpose AI agent. The goose review command, which uses the system's Git executable, does not properly strip attacker-controlled Git configuration. A malicious Git repository can set the core.fsmonitor option in its configuration, causing Git to execute arbitrary commands on the host during an index refresh. This allows a local attacker to execute commands with the privileges of the user running goose, potentially leading to unauthorized file access, modification, or the exfiltration of sensitive environment secrets and API keys.

This vulnerability is rated as an Important impact because successful exploitation permits arbitrary code execution under the privileges of the active user, compromising sensitive credentials, API keys, and local files. The issue is triggered when a developer executes the review workflow within an untrusted repository containing crafted configuration directives. Although user interaction is required to analyze untrusted code, execution occurs automatically before model interaction or agent permission checks take effect.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.