CVE-2026-85623: a shared Goose recipe could start commands before the user approved it

Vulnerability · Goose · HIGH

Incident dateNot stated

DisclosedJul 8, 2026 (public GitHub issue). CVE published Sep 4, 2026. Fix released Sep 23, 2026 in 1.52.0.

Added hereOct 14, 8:55 PM ET

Last verifiedOct 14, 2026

Summary

CVE-2026-85623 covers Goose recipes, shareable agent configs that can declare stdio extensions and retry.checks shell commands. Goose ran those commands when a recipe loaded, and its recipe security scan did not look at those fields. The CVE record lists goose up to 1.49.0 and a CVSS 4.0 score of 8.7. Goose's maintainers said the command-line behavior is by design, like running a shell script, but fixed the Desktop app so nothing starts until the user approves the recipe. That fix shipped in Goose 1.52.0 on Sep 23, 2026.

Severity

HIGH A recipe opened from a link could run commands as the user. CVSS 4.0 8.7 per the CVE record. Fixed for Desktop in 1.52.0; the CLI treats recipes as trusted scripts by design.

Timeline

Jul 8, 2026
Researcher George Chen opens GitHub issue #10325 after an earlier private report got no response.
Aug 3, 2026
A maintainer says the CLI case is not a security boundary violation but there may be a Desktop consent-ordering bug; the reporter reproduces pre-approval execution on Desktop 1.45.0.
Sep 4, 2026
CVE-2026-85623 published by VulnCheck.
Sep 16, 2026
Fix merged (PR #12094: require recipe consent before extensions start) and the issue is closed.
Sep 23, 2026
Goose 1.52.0 released with the fix.

How it happened

When a recipe ran, Goose started its declared extensions, which spawns whatever command the recipe names, before any consent screen. The built-in scan only checked the natural-language fields for hidden Unicode characters, so a recipe with a visible but malicious command passed with no warning. On Desktop, a goose:// deeplink could trigger this before the user clicked anything. The CVE record classifies it as CWE-94. The fix makes Desktop wait for approval before starting extensions. Maintainers consider goose run --recipe on the CLI an explicit choice to run the recipe.

How to check your app

Update Goose Desktop to 1.52.0 or later.
Before running a shared recipe, read its extensions (cmd and args) and retry.checks sections.
Treat goose run --recipe with an untrusted file like running an untrusted shell script.

Sources

Corrections and updates

None. Re-checked against every source on Oct 14, 2026.