Advisories · Technology

goose.

Every CVE that names goose among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-109561 CVE record

CVSS 2.3 Low

goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations
- goose
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-85623 CVE record

CVSS 8.7 High

goose 1.37.0 Arbitrary Command Execution via Recipe Extensions
- goose
- Code injection
Not analysed yet 4 Sept 2026
CVE-2026-72718 CVE record

CVSS 7.0 High

goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor
- goose
- Code injection
Not analysed yet 10 Aug 2026