Skip to content
Arbitrary Command Execution Vulnerability in Goose Review

Arbitrary Command Execution Vulnerability in Goose Review

First seen 14 Nov 2026, 15:43 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 14, 2026 at 15:43 UTC
  • •Goose Review is vulnerable to arbitrary command execution via malicious git repository configurations.
  • •The vulnerability was reported as GHSA-6mg9-3cvh-9939 and affects users running git diff commands.
  • •A pull request has been made to mitigate the risk by disabling external diff drivers.

A vulnerability in Goose Review allows arbitrary command execution via the diff.external configuration in git repositories. This issue, reported as GHSA-6mg9-3cvh-9939, affects users running Goose Review against untrusted repositories. The flaw arises because the git_command() and review_git_command() functions do not disable the diff.external setting, allowing malicious commands to execute during git diff operations. A pull request (PR 12537) has been submitted to address this issue by adding safeguards against external diff drivers and ensuring the --no-ext-diff flag is used. The vulnerability poses a risk to users who may inadvertently run commands from untrusted repositories. The fix has been implemented and confirmed by tests, but users are advised to remain cautious. Current status indicates that the issue has been patched, and no has been reported.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 8h ago How this analysis works

Timeline

2026-09-11
Vulnerability reported
The arbitrary command execution vulnerability in Goose Review was reported, linked to the diff.external configuration.
Article 1
2026-11-14
Pull request submitted
PR 12537 was submitted to address the vulnerability by adding safeguards against external diff drivers.
Article 2

More articles in this cluster (2)

Extracted Entities (3)

1 / 4

Common questions

What is the nature of the vulnerability?
The vulnerability allows arbitrary command execution through the diff.external configuration in git repositories.
How can I protect myself from this vulnerability?
Ensure that you are using the latest version of Goose Review with the applied fixes and avoid running reviews on untrusted repositories.
Is there any active exploitation of this vulnerability?
No active exploitation has been reported as of now, and the issue has been patched.