The vulnerability in aaif-goose's goose agent involves the 'goose review' command invoking 'git diff HEAD' to gather diffs without stripping attacker-controlled Git configuration. A malicious repository can set 'core.fsmonitor' to an arbitrary command, which Git executes during its index refresh. This command runs before any model interaction or user approval and outside of goose's tool-permission model, enabling arbitrary code execution with the user's privileges. The vulnerable Git invocations are implemented in the git_command() function in the source code and affect versions prior to 1.44.0. The issue is addressed in version 1.44.0.

An attacker controlling a malicious Git repository can execute arbitrary commands on the host machine with the privileges of the user running goose. This can lead to unauthorized file access or modification and exfiltration of environment secrets and API keys. The vulnerability does not require user interaction beyond running 'goose review' on the malicious repository. The CVSS 4.0 score is 7 (high severity), reflecting the local attack vector, low attack complexity, required user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade to aaif-goose goose version 1.44.0 or later, where this vulnerability is fixed. There is no official patch or temporary fix detailed beyond upgrading. Until then, avoid running 'goose review' on untrusted or potentially malicious Git repositories to prevent arbitrary command execution.