CVE-2026-129128
goose CLI 1.35.0 before 1.53.0 Command Execution via goose review diff.external
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by setting diff.external in a repository's .git/config. Attackers can ship a crafted repository that, when the victim runs goose review, executes git diff without --no-ext-diff, running commands as the user and exposing credentials and provider API keys.
| CWE | CWE-78 |
| Vendor | aaif-goose |
| Product | goose |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for aaif-goose goose
Be the first to know when new high vulnerabilities affecting aaif-goose goose are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
aaif-goose / goose
1.35.0 < 1.53.0
References
github.com: https://github.com/aaif-goose/goose/issues/12960 github.com: https://github.com/aaif-goose/goose github.com: https://github.com/aaif-goose/goose/commit/3fbea00fd44f6496ee4afe2b8b2897c3c95d63e9 github.com: https://github.com/aaif-goose/goose/pull/12537 github.com: https://github.com/aaif-goose/goose/pull/13469 github.com: https://github.com/aaif-goose/goose/releases/tag/v1.53.0 github.com: https://github.com/aaif-goose/goose/blob/302b60806639ea9f0ae8f053f49f8bf0e88b26f4/crates/goose-cli/src/commands/review/handler.rs#L400 vulncheck.com: https://www.vulncheck.com/advisories/goose-cli-1.35.0-before-1.53.0-command-execution-via-goose-review-diff-external
Credits
George Chen sandiyochristan