CVE-2026-85623: goose Recipe Extension RCE Vulnerability

CVE-2026-85623 Overview

CVE-2026-85623 is a code injection vulnerability [CWE-94] in goose version 1.37.0, an AI agent framework. The flaw allows attackers to execute arbitrary shell commands through malicious recipe files. Goose processes stdio extensions and retry.checks fields from recipes without applying its security inspection routine. The recipe security scan inspects other recipe components but skips extension definitions and retry configurations. An attacker who distributes a crafted recipe can execute commands with the privileges of the user running goose.

Critical Impact
Attackers can achieve arbitrary command execution on any system where a user loads a malicious goose recipe, leading to full compromise of the user account and any accessible data.

Affected Products

goose 1.37.0 (AI agent framework)
Recipe stdio extension processing in extension_manager.rs
Recipe retry.checks processing in recipe/mod.rs

Discovery Timeline

2026-09-04 - CVE-2026-85623 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85623

Vulnerability Analysis

Goose recipes describe repeatable AI agent workflows and can include extension definitions and retry logic. Recipes of type stdio instruct goose to spawn a local process and communicate with it over standard input and output. The retry.checks field defines shell-executed validation steps that run after an agent turn.

Goose ships a recipe security scan intended to catch malicious content before execution. The scan does not inspect stdio extension entries or retry.checks entries. A recipe that appears safe to the scanner can still cause goose to spawn attacker-chosen commands. Because recipes are commonly shared across teams, chat channels, or public repositories, the distribution path for a malicious recipe is low friction.

See the VulnCheck Security Advisory and GitHub Issue #10325 for the maintainer discussion and fix status.

Root Cause

The recipe validation pipeline enumerates a subset of recipe fields for security inspection. The extensions array (specifically stdio type entries) and the retry.checks array are not routed through the scanner. Both fields carry command strings that goose later executes verbatim through the operating system shell interface used by the extension manager and retry runner.

Attack Vector

An attacker crafts a goose recipe file containing a stdio extension or retry.checks step whose command field invokes an arbitrary program. The attacker delivers the recipe through any channel a user trusts for recipe sharing, including public repositories, wikis, chat messages, or email attachments. When the victim loads the recipe in goose 1.37.0, the recipe passes the built-in security scan. Goose then launches the specified command with the user's privileges during extension initialization or retry evaluation.

Relevant source paths are documented in the goose repository at extension_manager.rs and recipe/mod.rs. No verified public exploit code is available at the time of writing.

Detection Methods for CVE-2026-85623

Indicators of Compromise

Recipe files (YAML or JSON) containing extensions entries with type: stdio and unexpected cmd or command values pointing to shells, interpreters, or download utilities.
Recipe files containing retry.checks entries that invoke shell commands unrelated to the recipe's stated purpose.
Unexpected child processes of the goose binary such as sh, bash, powershell, curl, or wget.

Detection Strategies

Scan recipe repositories and local recipe directories for stdio extension declarations and retry.checks entries, and review the command strings manually.
Monitor process creation events where the parent process is goose and the child is a shell interpreter or network utility.
Alert on outbound network connections initiated by processes spawned as children of goose.

Monitoring Recommendations

Enable endpoint process telemetry on developer workstations that run goose and forward events to a central analytics platform.
Track file writes and executions from user profile directories following goose recipe loads.
Maintain an allowlist of approved goose recipes and audit deviations.

How to Mitigate CVE-2026-85623

Immediate Actions Required

Stop loading recipes from untrusted sources on goose 1.37.0 installations.
Inventory existing recipes and remove or quarantine any containing stdio extensions or retry.checks steps that were not authored internally.
Upgrade to a goose release that extends security scanning to extensions and retry configurations once available; track GitHub Issue #10325 for status.

Patch Information

Refer to the goose project repository and the VulnCheck Security Advisory for fix availability and version guidance. Users should move off 1.37.0 to a version where the recipe scanner inspects extension and retry fields.

Workarounds

Manually review every recipe file before loading it, paying explicit attention to the extensions and retry.checks sections.
Run goose under a low-privilege user account or inside a sandbox or container to limit blast radius of any executed command.
Restrict recipe distribution to a signed internal repository and block loading of recipes from arbitrary URLs.

bash

# Configuration example: audit local recipes for risky fields
grep -REn 'type:\s*stdio|retry:|checks:' ~/.config/goose/recipes/