attack vector is network; attack complexity is low; privileges required is none; user interaction is required; scope is changed; confidentiality impact is high; integrity impact is none; availability impact is none.
Affected products
Red Hat Enterprise Linux 10 and Red Hat Enterprise Linux 9
Classified as
CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 9
Subsystems
OT Supporting Infrastructure
Sectors
Multiple
What to Know
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases.