CVE-2026-52134-libiec61850

CVE-2026-52134: GOOSE replay and message-freshness handling in libiec61850 v1.6 Status CVE-2026-52134 has been assigned. Publication of the corresponding CVE Record is pending. Affected product Vendor: MZ Automation GmbH Product: libiec61850 Tested version: 1.6 Status of other versions: Not...

Fedora 44 : goose (2026-24f75e4c7a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-24f75e4c7a advisory. Update to 1.45.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

untitledgoosetool

Untitled Goose Tool The Goose is loose. Table of Contents About Getting Started Prerequisites Requirements Installing Usage Config GUI Auth Csv Honk Messagetrace Recommended Default Workflow Recommended Workflow for UAL Call with Time Bounds Considerations Known Issues Acknowledgements Contributi...

Important: Red Hat Security Advisory: goose bug fix and enhancement update

An update for goose is now available for Red Hat Enterprise Linux 9. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Security Fixes: goose: aws-smithy-json: Denial of Service via uncontrolled...

Important: Red Hat Security Advisory: goose bug fix and enhancement update

An update for goose is now available for Red Hat Enterprise Linux 10. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Security Fixes: goose: aws-smithy-json: Denial of Service via uncontrolled...

RHEL 9 : goose update (Important) (RHSA-2026:67595)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67595 advisory. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258...

RHEL 10 : goose update (Important) (RHSA-2026:67593)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67593 advisory. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258...

CVE-2026-85623

A flaw was found in goose. This vulnerability allows attackers to execute arbitrary commands by distributing malicious recipes that leverage insecure recipe standard input/output stdio extensions and retry checks. This bypasses the existing security scan, enabling the execution of shell commands...

SUSE CVE-2026-85623

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

CVE-2026-85623

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

CVE-2026-85623 goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

CVE-2026-85623 goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

CVE-2026-85623

goose v1.37.0 (by aaif-goose) contains an arbitrary command execution flaw in its recipe subsystem. The vulnerable components are stdio extensions and retry.checks within recipes, which are executed without passing through the recipe security scan—creating a bypass for attackers who distribute ma...

EUVD-2026-71230

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

CVE-2026-85623 goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

PT-2026-85547

Name of the Vulnerable Software and Affected Versions goose versions prior to 1.38.0 Description The software executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. This occurs because the recipe security scan skips these two fields, allowing...

CVE-2026-85623: Improper Control of Generation of Code

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

CVE-2026-72718

A flaw was found in goose, a general-purpose AI agent. The goose review command, which uses the system's Git executable, does not properly strip attacker-controlled Git configuration. A malicious Git repository can set the core.fsmonitor option in its configuration, causing Git to execute arbitra...

Linux Distros Unpatched Vulnerability : CVE-2026-72718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for...

CVE-2026-72718

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets core fsmonitor = causes Git to...