{"data":{"id":"f7dfffd9-e318-4f2d-8974-7b03996dc9bc","title":"CVE-2026-72718: goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system","summary":"goose is a general-purpose AI agent that runs on your machine. Before version 1.44.0, the `goose review` command had a security vulnerability where it ran Git commands without checking for malicious settings in a repository's `.git/config` file, allowing an attacker to execute arbitrary commands on your computer with your user's permissions and access to your environment secrets and API keys. This happened outside of goose's normal safety checks and permission system.","solution":"This issue is fixed in version 1.44.0. Update goose to version 1.44.0 or later.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72718","publishedAt":"2026-08-10T16:19:48.900Z","cveId":"CVE-2026-72718","cweIds":["CWE-94"],"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":["Goose"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-08-10T16:19:48.900Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"]}}