Goose: Sensitive information disclosure via terminal integration (CVE-2026-111079)

A vulnerability exists in the Goose terminal integration feature where shell command history is captured and transmitted verbatim to configured Large Language Model (LLM) providers without sanitization. This flaw causes sensitive user input, such as environment variables, API tokens, and passwords entered directly into the terminal, to be sent to external service providers.

Impact

Sensitive information exposure occurs when confidential credentials or secrets are inadvertently included in shell command history and subsequently forwarded to third-party LLM endpoints. This results in the loss of data confidentiality and potential compromise of services accessible via the leaked credentials.

Recommendation

• Review the configuration of Goose and identify all users with terminal integration enabled.
• Disable the terminal integration feature in Goose until a security update is applied to prevent the automatic transmission of command history.
• Conduct an audit of logs from configured LLM service providers to determine if sensitive information has been ingested during the period the terminal integration was active.
• Implement a policy to avoid typing secrets or credentials directly into terminal sessions where Goose or similar telemetry-collecting agents are active.