goose review command runs the system git to gather the diff it reviews, without stripping attacker-controlled git config. A malicious repository whose .git/config sets [core] fsmonitor = causes git to execute that command on the host during its index refresh ( git diff HEAD ). So running goose review inside a malicious repo runs attacker code - no submitted prompt, no model call, no tool approval, no trust prompt. The command executes before goose ever contacts the model.
goose 1.41.0 (latest at time of testing), Linux x64. The review command's context-gathering git is not sandboxed and is outside goose's LLM tool-permission model.
Arbitrary command execution with the privileges of the user running goose . The command runs unsandboxed and inherits the user's environment, so it can also exfiltrate environment secrets and provider API keys. Delivered by any path that places an attacker-controlled .git/config on disk before goose review is run against the folder (a repo shipped as an archive, a shared volume, a nested/auto-discovered repository, a CI checkout).
Download the PoC repo (attached) and extract it.
Run goose review inside it.
A calculator launches, with no interaction beyond invoking the subcommand. The PoC's only malicious content is a single line in .git/config that auto-detects macOS/Linux. Demo video attached.
In crates/goose-cli/src/commands/review/handler.rs , git_command() builds the review's git invocations with only -c core.quotePath=off — it does not strip core.fsmonitor . touched_files() and collect_diff() then run git diff --name-only HEAD / git diff HEAD to assemble the review context, which refreshes the index and invokes the attacker-controlled core.fsmonitor command.
Francisco Rosales of Manifold Security
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
