VulnSocial

CVE-2026-85623Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry configurations.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-09-04); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-09-04: 2Mentions · 2026-09-10: 1Patch / Workaround · 2026-09-10: 1Technical Details · 2026-09-04: 2Technical Details · 2026-09-10: 109-0409-10
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets1 URL
Classification over time
DateTotalLabels
2026-09-042
Disclosure2
2026-09-101
Patch1
Full discourse3 posts
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH: CVE-2026-85623 (CVSS 8.8) - goose 1.37.0 executes arbitrary commands via malicious recipes, bypassing security scans. Affects stdio extensions & retry[.]checks. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/P9aknFe9RE

    Post summary

    The tweet announces CVE‑2026‑85623, a high‑severity vulnerability in goose 1.37.0 that enables arbitrary command execution via malicious recipes, and stresses the need for immediate patching.

    0000044
    130 followersView on X
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨High - goose Recipe Extension Command Execution (CVE-2026-85623) goose executes arbitrary shell commands defined in recipe stdio extensions and retry.checks without inspection. A malicious recipe can bypass the recipe security scan by placing commands in extensions/retry config, leading to arbitrary command execution as the user running goose. 👉Affected: goose <= 1.49

    Post summary

    goose (≤1.49) is vulnerable to arbitrary shell command execution via recipe extension configuration (CVE-2026-85623), a high‑severity flaw announced in this advisory.

    0000065
    301 followersView on X
  • Severity Daily@severitydaily
    Disclosure

    goose's recipe security scan skips the two fields that execute commands. CVE-2026-85623 rates it 8.8 and names no fixed version; the affected range runs through the current release. No exploitation reported. https://severitydaily.com/goose-cve-2026-85623-recipe-extensions-retry-security-scan-gap/

    Post summary

    The post announces CVE-2026-85623, highlighting its command-execution weakness in goose's recipe security scan and its high CVSS score, with no evidence of active exploitation, PoC, or patch availability.

    0000017
    23 followersView on X

Explore more

Back to dashboard