CVE-2026-72718: goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system
Summary
goose is a general-purpose AI agent that runs on your machine. Before version 1.44.0, the `goose review` command had a security vulnerability where it ran Git commands without checking for malicious settings in a repository's `.git/config` file, allowing an attacker to execute arbitrary commands on your computer with your user's permissions and access to your environment secrets and API keys. This happened outside of goose's normal safety checks and permission system.
Solution / Mitigation
This issue is fixed in version 1.44.0. Update goose to version 1.44.0 or later.
Vulnerability Details
EPSS: 0.0%
August 10, 2026
Classification
Taxonomy References
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-72718
First tracked: August 10, 2026 at 02:08 PM
Classified by LLM (prompt v3) · confidence: 95%