Local Code Execution Vulnerability in Goose CLI by AAIF

CVE-2026-129128

What is CVE-2026-129128?

The Goose CLI has a significant local code execution vulnerability found in versions prior to 1.53.0. This issue arises when an attacker manipulates the diff.external setting within a repository's .git/config file. By crafting a malicious repository, an attacker can execute git diff commands with the --no-ext-diff option disabled during the goose review process. This execution could lead to arbitrary commands running in the context of the user, thereby potentially exposing sensitive information such as credentials and provider API keys.

References