Index

Search

Search the public record. Drafts and scheduled notes are not included.

news

Goose recipe command execution is CVE-2026-85623

VulnCheck published CVE-2026-85623 / GHSA-rh2p-fw5h-rc3m for Goose: recipe stdio extensions and retry checks can run shell commands the unicode recipe scan does not inspect. CVSS 3.1 8.8. Goose 1.52.0 ships a Desktop consent-before-session fix. A public PoC exists. Not in CISA KEV.

Published 3h ago

HighPoC Available

CVE-2026-85623

Goose recipe stdio extensions run commands without scan coverage

RCE

Published 4 Sept 2026