Description
Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by setting diff.external in a repository's .git/config. Attackers can ship a crafted repository that, when the victim runs goose review, executes git diff without --no-ext-diff, running commands as the user and exposing credentials and provider API keys.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| aaif-goose | goose | 1.35.0 <1.53.0 | — |
References
- https://github.com/aaif-goose/goose/issues/12960
- https://github.com/aaif-goose/goose
- https://github.com/aaif-goose/goose/commit/3fbea00fd44f6496ee4afe2b8b2897c3c95d63e9
- https://github.com/aaif-goose/goose/pull/12537
- https://github.com/aaif-goose/goose/pull/13469
- https://github.com/aaif-goose/goose/releases/tag/v1.53.0
- https://github.com/aaif-goose/goose/blob/302b60806639ea9f0ae8f053f49f8bf0e88b26f4/crates/goose-cli/src/commands/review/handler.rs#L400
- https://www.vulncheck.com/advisories/goose-cli-1.35.0-before-1.53.0-command-execution-via-goose-review-diff-external