A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim… (CVE-2026-111079)

CVE-2026-111079 describes a flaw in Goose where enabling the terminal integration feature results in the application transmitting unsanitized shell command history to external LLM provider endpoints during queries. This includes any sensitive information entered by users in the terminal, such as API tokens, passwords, or secret environment variables, crossing trust boundaries and potentially exposing confidential credentials to third parties and logs. The vulnerability has a CVSS 3.1 score of 7.4, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and a confidentiality impact classified as high.

Sensitive information entered in the terminal, including credentials and secrets, can be disclosed to external LLM providers and potentially logged, resulting in confidentiality breaches. There is no indication of integrity or availability impact. The exposure crosses trust boundaries, increasing risk to organizational secrets and user privacy.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the terminal integration feature to prevent sensitive command history from being transmitted. Avoid entering sensitive information in the terminal when this feature is enabled.