Which versions of goose AI agent are affected by EUVD-2026-55653?

The goose AI agent's `goose review` command contains an arbitrary code execution vulnerability that allows attackers to execute commands on developer workstations through malicious Git repositories,…. A patch is available.

How to fix or mitigate EUVD-2026-55653?

Within 24 hours: inventory all developers and systems running goose, disable or restrict the `goose review` command, and alert users to avoid running goose on untrusted repositories. Within 7 days: monitor credential usage and Git process logs for suspicious activity, and coordinate with the goose vendor to track patch availability. Within 30 days: apply the vendor patch immediately upon release, rotate any API keys and credentials potentially exposed during the vulnerability window, and audit repository access logs for unauthorized activity.

goose AI agent EUVD-2026-55653

Q: What is the CVSS score of EUVD-2026-55653?

EUVD-2026-55653 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-72718 HIGH

Code Injection (CWE-94)

2026-08-10 GitHub_M

RCE Code Injection Goose

7.0

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Local attack vector with low-privilege repo access and required user action (running goose review); full C/I/A impact on the user's system, no scope change.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Aug 10, 2026 - 17:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 16:05 vuln.today

Analysis Generated

Aug 10, 2026 - 16:05 vuln.today

CVE Published

Aug 10, 2026 - 15:33 cve.org

HIGH 7.0

DescriptionCVE.org

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets [core] fsmonitor = <command> causes Git to execute that command on the host during the index refresh performed by git diff HEAD. The command runs before goose contacts a model and without a submitted prompt, model call, tool approval, or trust prompt. The context-gathering Git process is not sandboxed and is outside goose's tool-permission model. Arbitrary commands run with the privileges and environment of the user running goose, allowing file access or modification and exfiltration of environment secrets and provider API keys. The vulnerable Git invocations are built by git_command() in crates/goose-cli/src/commands/review/handler.rs and are used by touched_files() and collect_diff() for git diff --name-only HEAD and git diff HEAD. This issue is fixed in version 1.44.0.

AnalysisAI

Arbitrary command execution in the goose AI agent's goose review command allows a malicious Git repository to run attacker-controlled code on the host before any model interaction occurs. The vulnerability exists in versions prior to 1.44.0 and stems from goose invoking the system git binary without suppressing the core.fsmonitor configuration key, meaning a repository's .git/config can nominate an arbitrary command that Git then executes during index refresh. Exploitation requires only that a user runs goose review inside a malicious repository, and the injected command inherits the user's full environment - including provider API keys and filesystem access. No public exploit has been identified at time of analysis, though the fix commit and advisory are public.

Technical ContextAI

The vulnerable component is git_command() in crates/goose-cli/src/commands/review/handler.rs, which previously called std::process::Command::new("git") directly without any hardening flags. Git's core.fsmonitor feature allows a repository-local .git/config to specify a shell command that Git runs during index refresh to accelerate change detection. When goose invoked git diff --name-only HEAD or git diff HEAD via touched_files() and collect_diff(), Git would honour the repo's core.fsmonitor setting and execute the attacker-nominated command. The root cause is CWE-94 (Improper Control of Generation of Code), specifically the failure to neutralize repository-controlled interpreter directives before passing control to a subordinate process. The fix, merged in v1.44.0, introduces a centralised git_command() helper in crates/goose/src/subprocess.rs that unconditionally prepends -c core.fsmonitor=false -c safe.bareRepository=explicit to every Git invocation, stripping the attacker's ability to inject hooks.

RemediationAI

Upgrade to goose version 1.44.0 or later, which is confirmed released at https://github.com/aaif-goose/goose/releases/tag/v1.44.0. The fix replaces all bare Command::new("git") calls with a hardened git_command() helper that unconditionally passes -c core.fsmonitor=false -c safe.bareRepository=explicit, neutralising repository-controlled hook injection. If an immediate upgrade is not possible, the primary compensating control is to avoid running goose review inside any repository whose .git/config or provenance you do not fully trust - this eliminates the attack surface entirely since the exploit requires a malicious repository to be the working directory. There is no network-level mitigation applicable, as the attack is entirely local. The trade-off of the workaround is operational: it prevents use of goose review on third-party or cloned repositories until the patch is applied. The advisory and fix commit are at https://github.com/aaif-goose/goose/commit/f8b5b7ba1fe6d006ccf6942f6b85a1bae985a2de.