CVE-2026-129128
HIGH
NVD
CVSS Score
7.8
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by setting diff.external in a repository's .git/config. Attackers can ship a crafted repository that, when the victim runs goose review, executes git diff without --no-ext-diff, running commands as the user and exposing credentials and provider API keys.
References
- https://github.com/aaif-goose/goose
- https://github.com/aaif-goose/goose/blob/302b60806639ea9f0ae8f053f49f8bf0e88b26f4/crates/goose-cli/src/commands/review/handler.rs#L400
- https://github.com/aaif-goose/goose/commit/3fbea00fd44f6496ee4afe2b8b2897c3c95d63e9
- https://github.com/aaif-goose/goose/issues/12960
- https://github.com/aaif-goose/goose/pull/12537