CVE-2026-72718

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-72718
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72718.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-72718
Aliases
  • GHSA-r5pp-p5r8-466r
Published
2026-08-10T15:33:37Z
Modified
2026-08-12T04:18:55Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor
Details

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets [core] fsmonitor = <command> causes Git to execute that command on the host during the index refresh performed by git diff HEAD. The command runs before goose contacts a model and without a submitted prompt, model call, tool approval, or trust prompt. The context-gathering Git process is not sandboxed and is outside goose's tool-permission model. Arbitrary commands run with the privileges and environment of the user running goose, allowing file access or modification and exfiltration of environment secrets and provider API keys. The vulnerable Git invocations are built by git_command() in crates/goose-cli/src/commands/review/handler.rs and are used by touched_files() and collect_diff() for git diff --name-only HEAD and git diff HEAD. This issue is fixed in version 1.44.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72718.json"
}
References

Affected packages

Git / github.com/aaif-goose/goose

Affected ranges

Type
GIT
Repo
https://github.com/aaif-goose/goose
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f8b5b7ba1fe6d006ccf6942f6b85a1bae985a2de
Fixed
876555f85b1bd0e15ed75eed7c5ac1163c1f097a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.44.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.11.0-nightly.20251022.23412e270f
1.11.0-nightly.20251023.8d9c19f2c2
1.8.0-nightly.20250915
1.8.0-nightly.20250916
1.8.0-nightly.20250917
1.8.0-nightly.20250918
1.8.0-nightly.20250919
1.8.0-nightly.20250920
1.8.0-nightly.20250921
1.8.0-nightly.20250923
1.8.0-nightly.20250924
1.8.0-nightly.20250925
1.8.0-nightly.20250926
1.8.0-nightly.20250927
1.8.0-nightly.20250928
1.8.0-nightly.20250929
1.8.0-nightly.20250930
1.8.0-nightly.20251001
1.8.0-nightly.20251002
1.8.0-nightly.20251003
1.8.0-nightly.20251004
1.8.0-nightly.20251005
1.8.0-nightly.20251006
1.8.0-nightly.20251007
1.8.0-nightly.20251008
1.8.0-nightly.20251009
1.8.0-nightly.20251010
1.8.0-nightly.20251011
1.8.0-nightly.20251012
Other
canary
ls
stable
v0.*
v0.8.0
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.9.0
v0.9.10
v0.9.11
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9
v1.*
v1.0-beta7
v1.0.0
v1.0.1
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.18
v1.0.19
v1.0.2
v1.0.20
v1.0.21
v1.0.22
v1.0.23
v1.0.24
v1.0.25
v1.0.26
v1.0.27
v1.0.28
v1.0.29
v1.0.3
v1.0.30
v1.0.31
v1.0.32
v1.0.33
v1.0.34
v1.0.35
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v2.*
v2.0-rc-04-27-0
v2.0.0-rc-04-27-0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72718.json"