Aaif-goose vulnerabilities
We track 3 vulnerabilities in Aaif-goose products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Aaif-goose vulnerabilities
- 7.8 High severity
goose: Improper Neutralization of Special Elements used in an OS Command
Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by setting diff.external in a repository's .git/config. Attackers can ship a crafted repository that, when the victim runs goose review, executes
- 8.8 High severity
goose: Improper Control of Generation of Code
goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does
- 7.0 High severity
goose: Improper Control of Generation of Code
goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose `.git/