AEV-2026-0016
Goose's goose review triggered a repository controlled Git command via core.fsmonitor (CVE-2026-72718)
Before Goose 1.44.0, the goose review command's own git diff context gathering honoured a repository's own core.fsmonitor Git setting, letting a malicious .git/config run an attacker named command before Goose contacted a model or requested any approval. Disclosed by Manifold Security as part of the broader GitSpawn class, patched in 1.44.0.
Affected
- Organisation
- unknown
- Product
- Goose CLI
- Component
- goose review's git diff HEAD context gathering subprocess
- Versions
- Goose CLI before 1.44.0; fixed in 1.44.0
- Configurations
- Repository's .git/config sets an executable core.fsmonitor helper
Execution authority facts
Fields the evidence does not establish are shown as unknown rather than guessed.
- Intended task
- Reviewing a repository's changes through the goose review command
- Agent
- Goose CLI (goose review)
- Delegating actor
- The developer running goose review against the repository
- Action
- Executed an attacker named command from the repository's own core.fsmonitor setting during Git's index refresh
- Target resource
- The host running Goose, with the developer's own privileges
- Environment
- A local developer workstation running goose review against an untrusted repository
- Credentials used
- unknown
- Privileges available
- The full privileges of the user account running Goose
- Authority presented
- None; the action ran as internal context gathering rather than a request the model or user approved
- Authority required
- Authorization for host code execution with the developer's own privileges
- Applicable policy
- unknown; Goose's own advisory does not describe an approval or sandbox policy this subprocess passed through
- Approval mechanism
- none
- Required approver
- unknown
- Independent approval
- no
- Action binding
- unknown
- Sequence context
- Ran during git diff HEAD context gathering, before Goose contacted a model or requested user approval
Impact
- Consequence
- Arbitrary command execution demonstrated with the developer's own privileges, before any model contact or approval
- Reach
- single
- Reversibility
- unknown
- Detectability
- silent
- Propagation
- potential
- Recovery
- unknown
Evidence
Primary sources
- Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor (GHSA-r5pp-p5r8-466r) (GitHub Security Advisories, goose)
Supporting sources
- GitSpawn: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, and Grok (Manifold Security)
- Reproduction status
- Vendor disclosed and patched; credited to Francisco Rosales of Manifold Security. Not independently reproduced by Moona Intelligence.
- Evidence state
- Confirmed
Known unknowns
- Whether this was exploited against a real deployment before the fix.
- What credentials or additional host access an executed command could reach beyond the demonstrated command execution.
Limitations
- Manifold's own GitSpawn blog post could not be directly fetched in this session and is corroborated through search rather than a direct read. Goose's own GitHub security advisory was fetched directly and is the primary basis for this entry's affected and patched versions, CVE and CVSS.
Claim provenance
- verified
Goose's own GitHub security advisory, read directly, states the mechanism in the vendor's own words, assigns CVE-2026-72718 and a CVSS 4.0 base score of 7.0, credits Francisco Rosales of Manifold Security as reporter, and records the affected range before 1.44.0 and the patched version 1.44.0.
The Agent Ran Code Before It Asked Whether You Trusted the Repository