CVE-2026-129128

EUVD-2026-125551
Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by setting diff.external in a repository's .git/config. Attackers can ship a crafted repository that, when the victim runs goose review, executes git diff without --no-ext-diff, running commands as the user and exposing credentials and provider API keys.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/aaif-goose/goose
https://github.com/aaif-goose/goose/blob/302b60806639ea9f0ae8f053f49f8bf0e88b26f4/crates/goose-cli/src/commands/review/handler.rs#L400
https://github.com/aaif-goose/goose/commit/3fbea00fd44f6496ee4afe2b8b2897c3c95d63e9
https://github.com/aaif-goose/goose/issues/12960
https://github.com/aaif-goose/goose/pull/12537
https://github.com/aaif-goose/goose/pull/13469
https://github.com/aaif-goose/goose/releases/tag/v1.53.0
https://www.vulncheck.com/advisories/goose-cli-1.35.0-before-1.53.0-command-execution-via-goose-review-diff-external