Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Goose core.fsmonitor command execution flaw (CVE-2026-72718)

Vulnerability
First reported
Last updated
Happening score
H score 17
1 unique sources, 1 articles

Summary

Hide ▲

goose fixed a repository-supplied command execution flaw in `core.fsmonitor`, leaving versions prior to 1.44.0 exposed until 1.44.0 shipped. GitHub assigned CVE-2026-72718 with a CVSS 4.0 7.0 score. A malicious repository could make goose run attacker code on the developer's machine before any model call or approval prompt.

Related Happenings

OpenAI Codex core.fsmonitor command execution flaw (CVE-2026-19592)

Vulnerability
H score17 First: 02.09.2026 17:06 Last: 02.09.2026 17:06 Sources 1

How related: "The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges. The code can read, change, or delete the user's files and access other resources available to the user's account," OpenAI said in the record for CVE-2026-19592.

About this happening: OpenAI Codex had a repository-supplied core.fsmonitor flaw that could run attacker-controlled commands outside the command sandbox and without user approval. A mal...

Open Happening

Linux distributions mitigation advisories for CVE-2026-31431

Advisory/Mitigation
H score39 First: 30.04.2026 12:24 Last: 30.04.2026 12:24 Sources 1

About this happening: Multiple Linux distributions released advisories for CVE-2026-31431, adding mitigation guidance for a Linux kernel local privilege escalation that can let an unprivile...

Open Happening

Vim and GNU Emacs file-open RCE flaws remote code execution flaw

Vulnerability
H score28 First: 01.04.2026 00:45 Last: 01.04.2026 00:45 Sources 1

About this happening: Vim and GNU Emacs have file-open remote code execution flaws that can run attacker code as soon as a crafted file is opened. The Vim issue affects 9.2.0271 and e...

Open Happening

BRICKSTORM backdoor activity and GRIMBOLT replacement on appliances

Malware Activity
H score29 First: 18.02.2026 12:32 Last: 18.02.2026 12:32 Sources 1

About this happening: BRICKSTORM is a Golang backdoor used by PRC state-sponsored actors to keep long-term persistence on VMware vSphere, Windows, and appliance environments. ...

Open Happening

Timeline

  1. 02.09.2026 17:06 2 articles · 2h ago

    Malicious repositories can make goose run attacker commands through core.fsmonitor

    Initial Disclosure

    Manifold Security disclosed that goose versions prior to 1.44.0 were vulnerable to a repository-supplied command execution flaw in `core.fsmonitor`, and GitHub assigned CVE-2026-72718 with a CVSS 4.0 base score of 7.0. A malicious repository with its `.git` directory intact can cause `goose review` to run attacker-controlled commands on the developer's machine outside the sandbox and before any model call or approval prompt; fixes had shipped for goose by publication.

    Show sources
    Open in new tab