RCE in Aaif-goose Goose
CVE-2026-72718
goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious re…
Vulnerability class: RCE (Remote Code Execution)
Affected products
- Aaif-goose Goose — versions < 1.44.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)