{"data":{"id":"8b18f371-d63a-4c2a-9e64-b6e5b13121e1","title":"CVE-2026-111079: A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command…","summary":"When the terminal integration feature is enabled in Goose, the application captures shell command history and sends it verbatim, without sanitization, to configured LLM provider endpoints during queries. Secrets a user types in the terminal, such as API tokens, passwords, or environment variables, are transmitted unredacted across trust boundaries, exposing them to external providers and logs.","solution":"N/A -- no mitigation discussed in source.","labels":["security","privacy"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111079","publishedAt":"2026-10-22T11:17:15.460Z","cveId":"CVE-2026-111079","cweIds":["CWE-497"],"cvssScore":"7.4","cvssSeverity":"high","severity":"high","attackType":["pii_leakage"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Goose"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Goose sends unsanitized terminal history to LLM provider endpoints","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-22T12:08:29.558Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-22T12:08:32.240Z","patchAvailable":null,"disclosureDate":"2026-10-22T11:17:15.460Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}