CVE-2026-85623

goose 1.37.0, an open-source AI agent CLI, executes shell commands declared in recipe stdio extensions and in retry.checks without any security inspection, so the built-in recipe security scan never reviews these components. An attacker who can convince a user to load a crafted recipe (for example shared via a repository or documentation) can have arbitrary shell commands run silently as that user, bypassing the scan-based trust indicator. Successful exploitation gives command execution with the victim user's privileges on their machine, enabling data theft, malware installation, or lateral movement; the CVSS 4.0 score of 8.7 reflects high impact on the compromised system but requires user interaction. Anyone running goose 1.37.0 who executes recipes from third parties is affected, and the advisory does not state a fixed version. No public proof-of-concept, no CISA KEV listing, and no reported in-the-wild exploitation are known; EPSS estimates a 0.4% probability of exploitation within 30 days.

What to do: Audit which goose version is in use and treat third-party recipes as untrusted input: until a patched release is announced, run only recipes from trusted sources and avoid untrusted recipes that define stdio extensions or retry.checks, since these bypass the recipe security scan. Monitor the vendor advisory for a fixed version, as none is stated in the current data.