Goose CLI Malicious Git Config Command Execution via `goose review`
First seen Aug 10, 2026 · Updated Aug 10, 2026
The `goose review` command in the goose AI agent invokes Git in a way that trusts repository-local configuration, allowing a malicious repository to execute arbitrary commands on the host simply by being reviewed. This happens automatically before any model interaction, prompt, or tool-approval step, bypassing goose's entire trust and permission model. An attacker can exfiltrate secrets, API keys, and modify files with the privileges of the user running goose.
Technical Analysis
The vulnerability lies in `git_command()` (crates/goose-cli/src/commands/review/handler.rs), which shells out to the system `git` binary to run `git diff --name-only HEAD` and `git diff HEAD` for `touched_files()` and `collect_diff()` without sanitizing or isolating the target repository's `.git/config`. Git supports a `core.fsmonitor` config directive that, when set to a command string, causes Git to execute that command during index refresh operations triggered by `git diff`. Because goose runs this diff-gathering step immediately upon invocation of `goose review`, a victim who simply points goose at a malicious or untrusted repository will have the attacker's command executed with no model call, no prompt submission, and no tool-approval gate—entirely outside goose's sandboxing and permission boundaries. This gives the attacker full command execution in the user's environment, enabling theft of environment variables, provider API keys, and modification/exfiltration of local files, effectively turning a benign 'review this repo' action into a supply-chain-style local compromise.
Affected Systems
goose (Block/Square goose AI agent CLI)
Detection Signatures
- Presence of 'core.fsmonitor' set to a shell command/script path in a cloned or untrusted repository's .git/config
- Unexpected child process spawned by the system git binary immediately after `goose review` is invoked, prior to any model/API call
- Git diff operations triggering execution of non-git executables or scripts
- Git invocations from goose-cli review handler (git_command(), touched_files(), collect_diff()) running against repositories not owned/verified by the user
- Outbound network connections or file reads of environment variables/API key files immediately following a `goose review` invocation
Remediation Steps
- 1
Upgrade goose
Update to goose version 1.44.0 or later, which fixes the unsafe Git invocation in the review handler.
- 2
Sanitize Git environment for context-gathering commands
When shelling out to git for diff/context operations, use GIT_CONFIG_NOSYSTEM, --git-dir with explicit safe.directory settings, or invoke git with -c core.fsmonitor= to override untrusted repo-level config before running diff commands.
- 3
Avoid running goose review on untrusted repositories
Until patched, do not run `goose review` or similar diff-gathering commands against repositories cloned from untrusted or unverified sources.
- 4
Sandbox context-gathering subprocesses
Bring all non-model, context-gathering tool invocations (like git diff) inside the same permission/sandboxing model as other agent tool calls, rather than exempting them as 'pre-model' operations.
- 5
Audit repository configs before review
Scan .git/config of repositories for suspicious core.fsmonitor, core.hooksPath, or other command-executing directives before allowing automated tooling to operate on them.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.