Threats tagged 'ghsa-m867-2v3c-r239'

Goose CLI versions from 1.35.0 up to but not including 1.53.0 contain a local code execution vulnerability. This flaw allows attackers to execute arbitrary commands by manipulating the diff.external setting in a repository's .git/config file. When a victim runs the 'goose review' command on a crafted repository, it triggers git diff without the --no-ext-diff option, enabling command execution as the user and potentially exposing sensitive credentials and API keys.