Live › vulnerability › CVE-2026-111079
Go to dashboardWhen Goose's terminal integration is enabled, it captures shell command history and sends it verbatim to the configured LLM provider during queries. Any secrets typed in the terminal, such as API tokens, passwords or environment variables, can reach the external provider and its logs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Goose with the terminal integration feature enabled and that type secrets into shell sessions being captured. The exposure path is the shell history sent to the configured LLM provider endpoint. Teams with the feature disabled, or that never enter secrets in captured terminals, are less exposed; the sources do not say which default applies.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.
This page as .md · .json · in your agent: get_signal("CVE-2026-111079")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.