CVE-2026-72718: Goose AI Agent RCE Vulnerability

CVE-2026-72718 Overview

CVE-2026-72718 affects goose, a general-purpose AI agent that runs locally on user machines. The goose review command invokes the system git executable to collect diffs without stripping attacker-controlled Git configuration. A malicious repository containing a .git/config with a core.fsmonitor directive causes Git to execute the attacker's command during index refresh. The command runs before goose contacts any model and without user prompts, tool approvals, or trust dialogs. This code injection flaw [CWE-94] enables arbitrary command execution with the privileges of the user running goose. The issue is fixed in version 1.44.0.

Critical Impact
Cloning and reviewing a malicious repository triggers arbitrary command execution outside goose's tool-permission model, exposing environment secrets and provider API keys.

Affected Products

goose AI agent versions prior to 1.44.0
goose review command in goose-cli crate
Any host system where goose is executed against untrusted repositories

Discovery Timeline

2026-08-10 - CVE-2026-72718 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72718

Vulnerability Analysis

The vulnerability resides in the git_command() function in crates/goose-cli/src/commands/review/handler.rs. This function constructs Git invocations used by touched_files() and collect_diff() to run git diff --name-only HEAD and git diff HEAD. Neither invocation strips the repository's local Git configuration or disables the core.fsmonitor hook.

When git diff HEAD refreshes the index, Git honors core.fsmonitor and executes the configured command. Because the context-gathering Git process is not sandboxed and sits outside goose's tool-permission model, commands run with the full privileges and environment of the invoking user. Attackers can read or modify files and exfiltrate provider API keys stored as environment variables.

Root Cause

The root cause is failure to sanitize or override attacker-controlled Git configuration when spawning git subprocesses. Git honors any executable-hook directives such as core.fsmonitor present in a repository's local .git/config. Because goose executes git without arguments like -c core.fsmonitor=false or a restricted environment, the trust boundary between untrusted repository content and host execution is broken.

Attack Vector

An attacker publishes or shares a repository containing a crafted .git/config. When a goose user clones the repository and runs goose review, the touched_files() and collect_diff() helpers invoke git diff HEAD. Git triggers the fsmonitor hook and executes the attacker's command before any model call or tool approval prompt.

rust

// Security patch: introduce a hardened git_command() helper
 use crate::session::{build_session, SessionBuilderConfig};

 use goose::checks::{discover, DiscoveredReview};
+use goose::subprocess::git_command;

 use super::orchestrator::{
     emit_findings, run_checks_in_parallel, run_main_pass_in_parallel, Severity,

Source: GitHub Commit f8b5b7b

Detection Methods for CVE-2026-72718

Indicators of Compromise

Repositories containing .git/config entries setting core.fsmonitor, core.sshCommand, or similar executable hooks
Child processes of git spawned with unexpected command lines shortly after goose review invocation
Outbound network connections from git or its children to unknown hosts during a review workflow
Read access to environment variables such as OPENAI_API_KEY, ANTHROPIC_API_KEY, or .env files by git-descended processes

Detection Strategies

Monitor process trees where goose or goose-cli invokes git and git in turn spawns non-Git binaries such as sh, bash, curl, or python
Alert on any invocation of git diff whose working directory contains a .git/config with a fsmonitor, hooksPath, or sshCommand setting
Correlate goose CLI activity with process creation, file access, and network telemetry to identify command execution occurring before any model call

Monitoring Recommendations

Enable command-line auditing for git executions and retain arguments and parent process context
Track access to developer secrets and cloud provider credentials from unexpected process ancestries
Baseline the expected child processes of goose workflows and alert on deviations

How to Mitigate CVE-2026-72718

Immediate Actions Required

Upgrade goose to version 1.44.0 or later, which routes Git invocations through the hardened git_command() helper
Avoid running goose review against untrusted or unverified repositories until the upgrade is complete
Rotate any provider API keys or secrets that may have been exposed on hosts where goose review ran against untrusted code

Patch Information

The fix is available in goose v1.44.0. The patch centralizes Git subprocess construction in a shared goose::subprocess::git_command helper that strips attacker-controlled configuration. See the GitHub Security Advisory GHSA-r5pp-p5r8-466r and the remediation commit for implementation details.

Workarounds

Inspect .git/config for fsmonitor, hooksPath, sshCommand, and similar directives before running goose review
Run goose inside a container or sandbox with no access to production secrets or credential files
Override risky Git settings globally by exporting GIT_CONFIG_GLOBAL to a hardened file that disables core.fsmonitor

bash

# Disable fsmonitor and untrusted hook execution before running goose review
export GIT_CONFIG_COUNT=2
export GIT_CONFIG_KEY_0=core.fsmonitor
export GIT_CONFIG_VALUE_0=false
export GIT_CONFIG_KEY_1=core.hooksPath
export GIT_CONFIG_VALUE_1=/dev/null
goose review