CVE-2026-85623
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry configurations.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| aaif-goose | goose | 0 <= 1.49.0 | affected |
Weaknesses
- CWE-94: Improper Control of Generation of Code ('Code Injection')
References
- https://github.com/aaif-goose/goose/issues/10325
- https://github.com/aaif-goose/goose
- https://github.com/aaif-goose/goose/blob/v1.49.0/crates/goose/src/recipe/mod.rs
- https://github.com/aaif-goose/goose/blob/v1.49.0/crates/goose/src/agents/extension_manager.rs
- https://www.vulncheck.com/advisories/goose-1.37.0-arbitrary-command-execution-via-recipe-extensions
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.