VulnSocial

CVE-2026-72718Disclosure

LOWCVSS 7.0 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts

Recommended action window: High priority (within 72h)

NVD description

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose `.git/config` sets [`core] fsmonitor = <command>` causes Git to execute that command on the host during the index refresh performed by `git diff HEAD`. The command runs before goose contacts a model and without a submitted prompt, model call, tool approval, or trust prompt. The context-gathering Git process is not sandboxed and is outside goose's tool-permission model. Arbitrary commands run with the privileges and environment of the user running goose, allowing file access or modification and exfiltration of environment secrets and provider API keys. The vulnerable Git invocations are built by git_command() in crates/goose-cli/src/commands/review/handler.rs and are used by touched_files() and collect_diff() for `git diff --name-only HEAD` and `git diff HEAD`. This issue is fixed in version 1.44.0.

Back to dashboard
2.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Exploit tooling references are present in monitored signal
  • Patch or workaround signal is available
  • 6 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 5 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • Peaked 3d ago at 2 mentions (2026-08-10); latest day: 1
  • 6 total mentions across 4 days

Deep dive

Activity timeline6 mentions / 4d
01122Mentions · 2026-08-10: 2Mentions · 2026-08-11: 1Mentions · 2026-09-01: 2Mentions · 2026-09-08: 1Exploit Tool / Code · 2026-09-08: 1Patch / Workaround · 2026-08-11: 1Patch / Workaround · 2026-09-01: 2Patch / Workaround · 2026-09-08: 1Technical Details · 2026-08-10: 1Technical Details · 2026-08-11: 1Technical Details · 2026-09-01: 2Technical Details · 2026-09-08: 108-1008-1109-0109-08
Signal classification3 categories
Disclosure
350.0%
Patch
233.3%
General
116.7%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-08-102
Disclosure1General1
2026-08-111
Disclosure1
2026-09-012
Patch2
2026-09-081
Disclosure1
Full discourse6 posts
  • Slade 🛡️ LLM Hacker@llm_redteam
    Disclosure

    Claude Code, Cursor, and Codex CVE-2026-19592 all got caught running attacker code before you ever see a trust prompt. Manifold Security found 8 of these flaws across 7 command-line coding agents: Claude Code, Cursor, Codex, Goose, Hermes Agent, Qwen Code, Grok Build. Same root cause every time. The bug lives in core.fsmonitor, a Git perf setting that names a command Git runs to check which files changed. Git reads that value straight from the repo's own.git/config. Any index refresh triggers it: git status, git diff, the branch check your agent runs silently on startup. On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt even shows up. On Qwen Code, before you've authenticated. On Grok Build, on the first keystroke. No prompt to the model. No tool approval. Just opening the folder is enough. Exploitation needs the.git folder intact: a shared drive, a synced folder, a USB stick, a zip a contractor sent you. A normal git clone strips this. But how many repos do you actually clone vs just copy from a client's shared drive? goose got CVSS 7.0 (CVE-2026-72718), fixed in 1.44.0. Claude Code patched the core.fsmonitor path in 2.1.196, but a second path through claude ultrareview was still live on 2.1.252 as of Sep 1. Codex CLI fixed in 0.131.0, covered by CVE-2026-19592. Hermes Agent, Qwen Code, Grok Build: still unpatched at publication. BEFORE (dangerous): agent runs git status/diff at session start to figure out branch and changes, before any trust decision, blindly trusting whatever the repo's.git/config says to run. AFTER (safe): sandbox every git subprocess call, strip or validate repo-supplied config keys (core.fsmonitor, hooks) before the first invocation, gate ANY git command behind the workspace-trust decision, not just tool calls. Building agents that touch untrusted repos? Go check which git commands yours fires before the user approves anything. Would you even notice if your CLI agent ran a command before you saw a trust prompt? #AISecurity #PromptInjection #SupplyChainSecurity

    Post summary

    The post reveals multiple CVE‑2026‑xxxx bugs in command‑line coding agents that allow attacker code to run via Git’s core.fsmonitor before user trust decisions, provides technical exploitation details, patch notes, and overall exposes the vulnerability.

    71044434
    1.3K followersView on X
  • Manifold Security@Manifold_ai_sec
    Patch

    Claude Code, Codex, Cursor, Goose, Hermes Agent, Qwen Code, Grok Build. 8 vulnerabilities, one pattern: git commands that run on startup, before any trust prompt. In the video: CVE-2026-72718 in Goose (patched). 4 patched, 4 open. Write-up by @0xmagic0 in the reply. https://t.co/TniefquVut

    Post summary

    The tweet highlights that CVE‑2026‑72718 in Goose has been patched, noting a pattern of git commands running at startup, and refers to a write‑up, but provides limited technical detail.

    201421.6K
    10 followersView on X
  • Francisco Rosales@0xmagic0
    Patch

    Claude Code, Hermes Agent, Goose, Grok Build, and Qwen Code. 5 popular CLI AI agents, 6 vulnerabilities leading to arbitrary command execution. That's what I'm discussing in my latest article. This video shows one of the patched vulnerabilities in Goose CLI (CVE-2026-72718) https://t.co/YX6oSeVhY3

    Post summary

    The passage highlights several CLI AI agent vulnerabilities, noting that one (CVE‑2026‑72718) has already been patched, as demonstrated in a linked video, with no evidence of active exploitation or PoC presented.

    20141379
    27 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-72718 goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for revie… https://www.cve.org/CVERecord?id=CVE-2026-72718

    Post summary

    The post references CVE‑2026‑72718 and notes that versions prior to 1.44.0 of goose run the system git executable, but it offers no further evidence of exploitation, patches, or detailed vulnerability specifics.

    000011.5K
    57.9K followersView on X
  • iSECTECH@isectech_
    Disclosure

    Goose before 1.44.0 can execute a malicious repository’s Git `core.fsmonitor` command during `goose review`—before a model call, prompt, or tool approval. Upgrade and inspect untrusted repos in an isolated, low-secret environment. https://nvd.nist.gov/vuln/detail/CVE-2026-72718

    Post summary

    The tweet announces a vulnerability in Goose (CVE-2026-72718) that allows arbitrary code execution via Git's `core.fsmonitor` and advises users to upgrade and inspect repositories.

    0000039
    87 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-72718 goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for revie… https://www.cve.org/CVERecord?id=CVE-2026-72718 ----- Traducción: CVE-2026-72718 goo… http://infoflow.cloud`

    Post summary

    CVE-2026-72718 affects the Goose AI agent, allowing it to run the system `git` executable for diff gathering, but no PoC, exploit code, or active exploitation is referenced. No patch or workaround is mentioned in the brief update.

    0000033
    98 followersView on X

Explore more

Back to dashboard