CVE-2026-85623
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry configurations.
Risk Assessment
The risk includes arbitrary command execution on behalf of the user, potentially leading to system compromise, data theft, or malware installation.
Recommendation
It is recommended to upgrade goose to a version that includes the fix, and to be cautious when using recipes from untrusted sources.
Other vulnerabilities in goose
See all- CVE-2026-111079High
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries.
- CVE-2026-109561Medium
goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.
- CVE-2026-72718High
goose before version 1.44.0 has a vulnerability where the `goose review` command runs `git` without sanitizing configuration, allowing a malicious repository to execute arbitrary commands on the host.
Original NVD description (English source)
goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry configurations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS