Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-109561 (GCVE-0-2026-109561)

Vulnerability from nvd – Published: 2026-10-12 20:55 – Updated: 2026-10-12 20:55

Title

goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations

Summary

goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6476 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/aaif-goose/goose/pull/10528	issue-trackingpatch
https://github.com/aaif-goose/goose/commit/b0f4e2…	patch
https://github.com/aaif-goose/goose/blob/v1.43.0/…	technical-description
https://github.com/aaif-goose/goose/releases/tag/…	release-notes
https://github.com/aaif-goose/goose	product
https://www.vulncheck.com/advisories/goose-from-1…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
aaif-goose	goose	Affected: 1.28.0 , < 1.44.0 (semver) Unaffected: 1.44.0 (semver)

Date Public

2026-07-17 00:00

Credits

Akıner Kısa Project Loupe

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "goose",
          "repo": "https://github.com/aaif-goose/goose",
          "vendor": "aaif-goose",
          "versions": [
            {
              "lessThan": "1.44.0",
              "status": "affected",
              "version": "1.28.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.44.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ak\u0131ner K\u0131sa"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Project Loupe"
        }
      ],
      "datePublic": "2026-07-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user\u0027s selected approval mode in PermissionInspector::inspect."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T20:55:15.574Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Pull Request #10528",
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/aaif-goose/goose/pull/10528"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aaif-goose/goose/commit/b0f4e2a0f1a5507aa0a0fbe73d0b5c77a3e86845"
        },
        {
          "name": "Vulnerable code in permission_inspector.rs",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/aaif-goose/goose/blob/v1.43.0/crates/goose/src/permission/permission_inspector.rs#L159"
        },
        {
          "name": "goose v1.44.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/aaif-goose/goose/releases/tag/v1.44.0"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/aaif-goose/goose"
        },
        {
          "name": "VulnCheck Advisory: goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/goose-from-1.28.0-before-1.44.0-manual-approval-bypass-via-read-only-tool-annotations"
        }
      ],
      "title": "goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109561",
    "datePublished": "2026-10-12T20:55:15.574Z",
    "dateReserved": "2026-10-12T19:27:51.947Z",
    "dateUpdated": "2026-10-12T20:55:15.574Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85623 (GCVE-0-2026-85623)

Vulnerability from nvd – Published: 2026-09-04 14:32 – Updated: 2026-09-10 15:08

Title

goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

Summary

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry configurations.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 14:27 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6476 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/aaif-goose/goose/issues/10325	issue-tracking
https://github.com/aaif-goose/goose	product
https://github.com/aaif-goose/goose/blob/v1.49.0/…	technical-description
https://github.com/aaif-goose/goose/blob/v1.49.0/…	technical-description
https://www.vulncheck.com/advisories/goose-1.37.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
aaif-goose	goose	Affected: 0 , ≤ 1.49.0 (semver)

Date Public

2026-07-08 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85623",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T14:27:54.586430Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T15:08:38.210Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "goose",
          "vendor": "aaif-goose",
          "versions": [
            {
              "lessThanOrEqual": "1.49.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-07-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry configurations."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T14:32:13.978Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #10325",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/aaif-goose/goose/issues/10325"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/aaif-goose/goose"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/aaif-goose/goose/blob/v1.49.0/crates/goose/src/recipe/mod.rs"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/aaif-goose/goose/blob/v1.49.0/crates/goose/src/agents/extension_manager.rs"
        },
        {
          "name": "VulnCheck Advisory: goose 1.37.0 Arbitrary Command Execution via Recipe Extensions",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/goose-1.37.0-arbitrary-command-execution-via-recipe-extensions"
        }
      ],
      "title": "goose 1.37.0 Arbitrary Command Execution via Recipe Extensions",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-85623",
    "datePublished": "2026-09-04T14:32:13.978Z",
    "dateReserved": "2026-09-04T11:03:33.316Z",
    "dateUpdated": "2026-09-10T15:08:38.210Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-72718 (GCVE-0-2026-72718)

Vulnerability from nvd – Published: 2026-08-10 15:33 – Updated: 2026-08-10 17:00

Title

goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor

Summary

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose `.git/config` sets [`core] fsmonitor = <command>` causes Git to execute that command on the host during the index refresh performed by `git diff HEAD`. The command runs before goose contacts a model and without a submitted prompt, model call, tool approval, or trust prompt. The context-gathering Git process is not sandboxed and is outside goose's tool-permission model. Arbitrary commands run with the privileges and environment of the user running goose, allowing file access or modification and exfiltration of environment secrets and provider API keys. The vulnerable Git invocations are built by git_command() in crates/goose-cli/src/commands/review/handler.rs and are used by touched_files() and collect_diff() for `git diff --name-only HEAD` and `git diff HEAD`. This issue is fixed in version 1.44.0.

Severity

7 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-10 16:59 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7612 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/aaif-goose/goose/security/advi…	x_refsource_CONFIRM
https://github.com/aaif-goose/goose/commit/f8b5b7…	x_refsource_MISC
https://github.com/aaif-goose/goose/releases/tag/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aaif-goose	goose	Affected: < 1.44.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72718",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T16:59:40.746610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T17:00:09.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "goose",
          "vendor": "aaif-goose",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.44.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose `.git/config` sets [`core] fsmonitor = \u003ccommand\u003e` causes Git to execute that command on the host during the index refresh performed by `git diff HEAD`. The command runs before goose contacts a model and without a submitted prompt, model call, tool approval, or trust prompt. The context-gathering Git process is not sandboxed and is outside goose\u0027s tool-permission model. Arbitrary commands run with the privileges and environment of the user running goose, allowing file access or modification and exfiltration of environment secrets and provider API keys. The vulnerable Git invocations are built by git_command() in crates/goose-cli/src/commands/review/handler.rs and are used by touched_files() and collect_diff() for `git diff --name-only HEAD` and `git diff HEAD`. This issue is fixed in version 1.44.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T15:33:37.691Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r"
        },
        {
          "name": "https://github.com/aaif-goose/goose/commit/f8b5b7ba1fe6d006ccf6942f6b85a1bae985a2de",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aaif-goose/goose/commit/f8b5b7ba1fe6d006ccf6942f6b85a1bae985a2de"
        },
        {
          "name": "https://github.com/aaif-goose/goose/releases/tag/v1.44.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aaif-goose/goose/releases/tag/v1.44.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r5pp-p5r8-466r",
        "discovery": "UNKNOWN"
      },
      "title": "goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-72718",
    "datePublished": "2026-08-10T15:33:37.691Z",
    "dateReserved": "2026-08-10T13:48:09.545Z",
    "dateUpdated": "2026-08-10T17:00:09.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109561 (GCVE-0-2026-109561)

Vulnerability from cvelistv5 – Published: 2026-10-12 20:55 – Updated: 2026-10-12 20:55

Title

goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations

Summary

goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6476 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/aaif-goose/goose/pull/10528	issue-trackingpatch
https://github.com/aaif-goose/goose/commit/b0f4e2…	patch
https://github.com/aaif-goose/goose/blob/v1.43.0/…	technical-description
https://github.com/aaif-goose/goose/releases/tag/…	release-notes
https://github.com/aaif-goose/goose	product
https://www.vulncheck.com/advisories/goose-from-1…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
aaif-goose	goose	Affected: 1.28.0 , < 1.44.0 (semver) Unaffected: 1.44.0 (semver)

Date Public

2026-07-17 00:00

Credits

Akıner Kısa Project Loupe

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "goose",
          "repo": "https://github.com/aaif-goose/goose",
          "vendor": "aaif-goose",
          "versions": [
            {
              "lessThan": "1.44.0",
              "status": "affected",
              "version": "1.28.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.44.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ak\u0131ner K\u0131sa"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Project Loupe"
        }
      ],
      "datePublic": "2026-07-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user\u0027s selected approval mode in PermissionInspector::inspect."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T20:55:15.574Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Pull Request #10528",
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/aaif-goose/goose/pull/10528"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aaif-goose/goose/commit/b0f4e2a0f1a5507aa0a0fbe73d0b5c77a3e86845"
        },
        {
          "name": "Vulnerable code in permission_inspector.rs",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/aaif-goose/goose/blob/v1.43.0/crates/goose/src/permission/permission_inspector.rs#L159"
        },
        {
          "name": "goose v1.44.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/aaif-goose/goose/releases/tag/v1.44.0"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/aaif-goose/goose"
        },
        {
          "name": "VulnCheck Advisory: goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/goose-from-1.28.0-before-1.44.0-manual-approval-bypass-via-read-only-tool-annotations"
        }
      ],
      "title": "goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109561",
    "datePublished": "2026-10-12T20:55:15.574Z",
    "dateReserved": "2026-10-12T19:27:51.947Z",
    "dateUpdated": "2026-10-12T20:55:15.574Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85623 (GCVE-0-2026-85623)

Vulnerability from cvelistv5 – Published: 2026-09-04 14:32 – Updated: 2026-09-10 15:08

Title

goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

Summary

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry configurations.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 14:27 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6476 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/aaif-goose/goose/issues/10325	issue-tracking
https://github.com/aaif-goose/goose	product
https://github.com/aaif-goose/goose/blob/v1.49.0/…	technical-description
https://github.com/aaif-goose/goose/blob/v1.49.0/…	technical-description
https://www.vulncheck.com/advisories/goose-1.37.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
aaif-goose	goose	Affected: 0 , ≤ 1.49.0 (semver)

Date Public

2026-07-08 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85623",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T14:27:54.586430Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T15:08:38.210Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "goose",
          "vendor": "aaif-goose",
          "versions": [
            {
              "lessThanOrEqual": "1.49.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-07-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry configurations."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T14:32:13.978Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #10325",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/aaif-goose/goose/issues/10325"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/aaif-goose/goose"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/aaif-goose/goose/blob/v1.49.0/crates/goose/src/recipe/mod.rs"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/aaif-goose/goose/blob/v1.49.0/crates/goose/src/agents/extension_manager.rs"
        },
        {
          "name": "VulnCheck Advisory: goose 1.37.0 Arbitrary Command Execution via Recipe Extensions",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/goose-1.37.0-arbitrary-command-execution-via-recipe-extensions"
        }
      ],
      "title": "goose 1.37.0 Arbitrary Command Execution via Recipe Extensions",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-85623",
    "datePublished": "2026-09-04T14:32:13.978Z",
    "dateReserved": "2026-09-04T11:03:33.316Z",
    "dateUpdated": "2026-09-10T15:08:38.210Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-72718 (GCVE-0-2026-72718)

Vulnerability from cvelistv5 – Published: 2026-08-10 15:33 – Updated: 2026-08-10 17:00

Title

goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor

Summary

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose `.git/config` sets [`core] fsmonitor = <command>` causes Git to execute that command on the host during the index refresh performed by `git diff HEAD`. The command runs before goose contacts a model and without a submitted prompt, model call, tool approval, or trust prompt. The context-gathering Git process is not sandboxed and is outside goose's tool-permission model. Arbitrary commands run with the privileges and environment of the user running goose, allowing file access or modification and exfiltration of environment secrets and provider API keys. The vulnerable Git invocations are built by git_command() in crates/goose-cli/src/commands/review/handler.rs and are used by touched_files() and collect_diff() for `git diff --name-only HEAD` and `git diff HEAD`. This issue is fixed in version 1.44.0.

Severity

7 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-10 16:59 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7612 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/aaif-goose/goose/security/advi…	x_refsource_CONFIRM
https://github.com/aaif-goose/goose/commit/f8b5b7…	x_refsource_MISC
https://github.com/aaif-goose/goose/releases/tag/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aaif-goose	goose	Affected: < 1.44.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72718",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T16:59:40.746610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T17:00:09.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "goose",
          "vendor": "aaif-goose",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.44.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose `.git/config` sets [`core] fsmonitor = \u003ccommand\u003e` causes Git to execute that command on the host during the index refresh performed by `git diff HEAD`. The command runs before goose contacts a model and without a submitted prompt, model call, tool approval, or trust prompt. The context-gathering Git process is not sandboxed and is outside goose\u0027s tool-permission model. Arbitrary commands run with the privileges and environment of the user running goose, allowing file access or modification and exfiltration of environment secrets and provider API keys. The vulnerable Git invocations are built by git_command() in crates/goose-cli/src/commands/review/handler.rs and are used by touched_files() and collect_diff() for `git diff --name-only HEAD` and `git diff HEAD`. This issue is fixed in version 1.44.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T15:33:37.691Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r"
        },
        {
          "name": "https://github.com/aaif-goose/goose/commit/f8b5b7ba1fe6d006ccf6942f6b85a1bae985a2de",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aaif-goose/goose/commit/f8b5b7ba1fe6d006ccf6942f6b85a1bae985a2de"
        },
        {
          "name": "https://github.com/aaif-goose/goose/releases/tag/v1.44.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aaif-goose/goose/releases/tag/v1.44.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r5pp-p5r8-466r",
        "discovery": "UNKNOWN"
      },
      "title": "goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-72718",
    "datePublished": "2026-08-10T15:33:37.691Z",
    "dateReserved": "2026-08-10T13:48:09.545Z",
    "dateUpdated": "2026-08-10T17:00:09.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities by aaif-goose

CVE-2026-109561 (GCVE-0-2026-109561)

CVE-2026-85623 (GCVE-0-2026-85623)

CVE-2026-72718 (GCVE-0-2026-72718)

CVE-2026-109561 (GCVE-0-2026-109561)

CVE-2026-85623 (GCVE-0-2026-85623)

CVE-2026-72718 (GCVE-0-2026-72718)