aaif-goose

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

aaif-goose records in CISA KEV

No aaif-goose vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-50953 CVE-2026-72718

goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor

HIGH 66

goose is general-purpose AI agent that runs on your machine.

CVSS 4.0HIGH 7.0 Local Low privileges User interaction EPSS 0.00216 Published 2026-08-10 Fixed in 1.44.0 CWE-94

TI-2026-58748 CVE-2026-85623 · GHSA-rh2p-fw5h-rc3m

goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

MEDIUM 46

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00585 Published 2026-09-04 No fix listed CWE-94

TI-2026-71291 CVE-2026-109561 · GHSA-8h69-7j5q-pwfc

Manual approval bypass in goose via read-only tool annotations

LOW 11

goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_go…

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00195 Published 2026-10-12 Fixed in 1.44.0 CWE-863

Open these records in search →

Critical	0
High	2
Medium	0
Low	1
No CVSS	0