Threat · curated 14 Aug 2026
NVD - CVE-2026-72718
First reported nist.gov
Coverage timeline
Single-source advisory — first reported, latest, and curated coincide.
Why it matters
CVE-2026-72718 lets a malicious repository achieve unsandboxed arbitrary command execution on a developer's machine simply by running an AI agent's review command, bypassing the agent's entire tool-permission and trust model.
CVE-2026-72718 affects the goose general-purpose AI agent before version 1.44.0, where the `goose review` command runs the host `git` executable to gather a diff without stripping attacker-controlled Git configuration. A malicious repository whose `.git/config` sets `core.fsmonitor` causes Git to execute arbitrary commands on the host during `git diff HEAD`, running before any model call, prompt, or tool-approval prompt, outside goose's tool-permission model, enabling secret and API-key exfiltration. The issue is fixed in version 1.44.0.
Summary
CVE-2026-72718 is a code-injection vulnerability (CWE-94) in goose, a general-purpose AI agent that runs on a user's machine. In versions prior to 1.44.0, the `goose review` command invokes the system git executable to gather a diff for review without stripping attacker-controlled Git configuration, allowing a malicious repository to achieve arbitrary command execution on the host.[1]
The vulnerability is notable because the malicious command executes before goose contacts any model and requires no submitted prompt, model call, tool approval, or trust prompt, and the context-gathering Git process is neither sandboxed nor governed by goose's tool-permission model. GitHub, Inc. rated it CVSS 4.0 7.0 HIGH, and it is fixed in version 1.44.0.[1]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-08-10 | CVE-2026-72718 published to the NVD by GitHub, Inc., with description, CVSS 4.0 vector, CWE-94, and references to the fix commit, v1.44.0 release, and GHSA advisory.[1] |
| 2026-08-10 | CISA-ADP modified the record, adding the GHSA advisory reference and an SSVC assessment noting proof-of-concept exploitation, not automatable, with total technical impact.[1] |
How it works
When `goose review` runs, it calls the system git binary to gather a diff without removing attacker-controlled Git configuration. A malicious repository whose .git/config sets `[core] fsmonitor = <command>` causes Git to execute that command on the host during the index refresh performed by `git diff HEAD`. The vulnerable invocations are constructed by git_command() in crates/goose-cli/src/commands/review/handler.rs and used by touched_files() and collect_diff() for `git diff --name-only HEAD` and `git diff HEAD`.[1]
Because the Git process is not sandboxed and sits outside goose's tool-permission model, arbitrary commands run with the privileges and environment of the user running goose, enabling file access or modification and exfiltration of environment secrets and provider API keys. Execution occurs before any model interaction and without user approval.[1]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| goose (aaif-goose) | All versions prior to 1.44.0 | Fixed in version 1.44.0[1] |
Key takeaways
- AI agent tooling that shells out to git can inherit git's own code-execution features (such as core.fsmonitor) as an injection vector, executing attacker-controlled commands outside the agent's permission and sandbox model.[1]
- The exploit runs before any model interaction and without user approval, so trust prompts and tool-permission controls do not mitigate it; the fix (v1.44.0) works by stripping attacker-controlled Git configuration during context gathering.[1]
Defensive actions
- Upgrade goose to version 1.44.0 or later.: Version 1.44.0 contains the fix that strips attacker-controlled Git configuration before running the review diff, eliminating the code-injection path.[1]
- Avoid running `goose review` against untrusted or attacker-controlled repositories on vulnerable versions.: A malicious .git/config with a core.fsmonitor command triggers arbitrary command execution during the diff gathering, before any model call or approval prompt.[1]