aaif-goose goose vulnerabilities, newest first
Filter
By year: all 2026 2025 2024 2023 2022 2021
- 8.4CVE-2026-129128
Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by setting diff.external in a repository's .git/config. Attackers can ship a crafted repository that, when the victim runs g…
- 2.3CVE-2026-109561EPSS 0.2%
goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a s…
- 8.7CVE-2026-85623EPSS 0.6%
goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe secu…
- 7.0CVE-2026-72718EPSS 0.2%
goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious re…