The vulnerability is a CWE‑94 (Command Injection) and a CWE‑78 (OS Command Injection) that allows an attacker to execute arbitrary shell commands on the host running the goose CLI. The goose review command calls the system git executable without sanitizing its configuration. A malicious repository that sets core.fsmonitor to a command causes git to execute that command during git diff when goose review is run. The command executes before any model call and outside goose’s tool‑permission sandbox, giving the attacker full access to the user’s environment, files, secrets, and API keys.

The affected product is aaif‑goose version 1.43.x and earlier. The fix was introduced in release 1.44.0. No other products or versions are affected; the issue originates from goose’s handling of git configuration while gathering review context from local repositories.

The CVSS score of 7 indicates a high severity. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog; however, it is highly actionable locally. Attackers only need to place a malicious repository or modify the .git/config within the repository being reviewed and then invoke goose review. No network interaction is required, and the attack remains purely local but grants the attacker the same privileges as the user running goose.