Loading vulnerability…
CVE-2026-72718 is an OS command injection vulnerability in Goose versions before 1.44.0. The goose review workflow invokes the system Git client to enumerate changed files and collect a diff. These Git invocations do not neutralize repository-controlled Git configuration. An attacker can supply a repository whose local core.fsmonitor setting specifies an external command; Git executes that command while refreshing its index during the diff operation. Execution occurs before Goose contacts a model and outside Goose's tool-approval and sandboxing controls.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
goose review. This can enable reading, modifying, or deleting user-accessible files; exfiltrating environment-resident secrets and provider API credentials; and performing further actions available to that user account.If you can’t patch tonight, do this now.
goose review on untrusted repositories or repositories received with unverified repository-local Git configuration until upgraded. Inspect received repository configuration for external-helper settings, especially core.fsmonitor, before use. Where operationally appropriate, disable fsmonitor globally or ensure Git background operations explicitly override core.fsmonitor to false. Run reviews of untrusted projects in a restricted, disposable environment with minimal credentials and secrets.Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in the goose package for Fedora 45 addressed by Fedora advisory 2026-cb99e9b2ac. The supplied metadata presents conflicting CVSS v3 and v4 attack vectors, so the content alone does not establish a definitive exploit path.
A vulnerability tracked as CVE-2026-72718 affecting the goose package on Fedora 44. The supplied CVSS v3 vector rates it as a network-accessible, low-complexity, unauthenticated issue with high confidentiality, integrity, and availability impact.
An arbitrary command execution vulnerability in Goose's `goose review` functionality, triggered through a malicious Git configuration.
An arbitrary command-execution vulnerability in Goose's `goose review` functionality, triggered through a malicious Git configuration.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.