Goose exposes a flaw in its terminal integration feature, capturing shell command history and transmitting it unchanged to configured LLM endpoints. The data, which may include API tokens, passwords, or other credentials, is sent across trust boundaries without any sanitization. This results in a leakage of confidential information that can be intercepted by external service providers, log collectors, or malicious actors. The weakness falls under CWE‑497, an Information Leakage vulnerability that compromises confidentiality.

The vulnerability affects Red Hat Enterprise Linux 10 and Red Hat Enterprise Linux 9 where Goose is installed. No specific version strings are supplied, so all current releases of Goose bundled with these RHEL versions are potentially impacted.

The CVSS score of 7.4 indicates a high severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV database. Based on the description, the most likely attack vector is a local user with the terminal integration enabled who has access to the terminal session; the attacker could trigger the leak by entering sensitive data and prompting Goose to send queries to the LLM provider. Since no exploit code is publicly available or detailed, the exact likelihood of exploitation remains uncertain, but the potential for exposure of credentials is significant.