---
id: "CVE-2026-111079"
kind: "vulnerability"
aliases: ["CVE-2026-111079"]
title: "Goose: terminal integration sends unredacted shell history to LLM providers"
severity: "high"
cvss: 7.4
epss: 0.00229
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "developer-workstations", "goose", "llm"]
not_affected_if: ["terminal-integration-disabled"]
published_at: "2026-10-22T11:17:15+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:25:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111079", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111079", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Goose: terminal integration sends unredacted shell history to LLM providers

When Goose's terminal integration is enabled, it captures shell command history and sends it verbatim to the configured LLM provider during queries. Any secrets typed in the terminal, such as API tokens, passwords or environment variables, can reach the external provider and its logs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the terminal integration feature in Goose is enabled in its configuration (unknown: the exact setting name is not in the sources).
- Check the installed Goose version against the fixed release (unknown: the sources do not name a fixed version).

## Fix

- Disable the Goose terminal integration feature until a fixed version is installed (unknown: the sources do not name a fixed version).
- Rotate any API tokens or passwords that may have been typed into a terminal session while the feature was enabled.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111079
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111079

## From the sources

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_