CVE-2026-85623

goose: Goose: Arbitrary Command Execution via Recipe Extensions

Loading…

Severity

Important

Red Hat Product Security

8.8

CVSS 3.1

Review impact separately from score.

Published · September 4, 2026

Updated · November 5, 2026

Description

A flaw was found in goose. This vulnerability allows attackers to execute arbitrary commands by distributing malicious recipes that leverage insecure recipe standard input/output (stdio) extensions and retry checks. This bypasses the existing security scan, enabling the execution of shell commands with the privileges of the user running goose.

Statement

Red Hat Enterprise Linux 9 and 10 and Fedora ship goose versions prior to 1.37.0 and are not affected by this vulnerability. The EPEL package ships a version in the affected range.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-78 · Improper Neutralization of Special Elements used in an OS Command