Skip to content
Critical Arbitrary Command Execution Flaw in Fedora Goose

Critical Arbitrary Command Execution Flaw in Fedora Goose

First seen 27 Sep 2026, 19:07 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 27, 2026 at 19:57 UTC
  • •CVE-2026-72718 enables arbitrary command execution in Goose CLI.
  • •Exploitation of this vulnerability has been confirmed by CISA.
  • •Affected Fedora versions include 43, 44, and 45; users must update to version 1.45.0.

A critical arbitrary command execution vulnerability (CVE-2026-72718) has been identified in the Goose CLI tool used in Fedora 43, 44, and 45. The flaw allows attackers to execute arbitrary commands via the `goose review` command. CISA has confirmed that this vulnerability is being actively exploited in the wild. Affected systems include Fedora versions 43, 44, and 45, which utilize the Goose CLI. Users are urged to apply the security update (version 1.45.0) released on August 20, 2026, to mitigate the risk. The vulnerability has been assigned a CVSS score indicating its critical nature. Organizations should verify their systems and apply the necessary patches immediately to prevent exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-08-10
CVE-2026-72718 published
A critical vulnerability in Goose CLI was disclosed, allowing arbitrary command execution.
Linuxsecurity
2026-08-20
Security update released
Fedora released version 1.45.0 to address the arbitrary command execution flaw.
Linuxsecurity
Recent
Active exploitation confirmed
CISA confirmed that the vulnerability is being actively exploited in the wild.
Linuxsecurity

More articles in this cluster (3)

Following this threat?

Track CVE-2026-72718 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 4