Vulnerabilities

TI-2026-71291 CVE-2026-109561 · GHSA-8h69-7j5q-pwfc

Manual approval bypass in goose via read-only tool annotations

LOW 11

goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_go…

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00195 Published 2026-10-12 Fixed in 1.44.0 CWE-863

TI-2026-58748 CVE-2026-85623 · GHSA-rh2p-fw5h-rc3m

goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

MEDIUM 46

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00585 Published 2026-09-04 No fix listed CWE-94

TI-2026-50953 CVE-2026-72718

goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor

HIGH 66

goose is general-purpose AI agent that runs on your machine.

CVSS 4.0HIGH 7.0 Local Low privileges User interaction EPSS 0.00216 Published 2026-08-10 Fixed in 1.44.0 CWE-94

Vulnerabilities

Filters

Manual approval bypass in goose via read-only tool annotations

goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor