Description

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry configurations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-04T15:17:42.587Z",
  "pubdate": "2026-09-04T15:17:42.587Z",
  "executiveSummary": "Goose version 1.37.0 is susceptible to an arbitrary command execution vulnerability stemming from inadequate security validation within its recipe processing engine.\nThe vulnerability type is categorized as Improper Neutralization of Special Elements used in an OS Command (OS Command Injection).\nAn attacker can craft and distribute malicious recipes containing specifically formatted stdio extensions or retry.checks configurations to achieve remote code execution (RCE) with the privileges of the user executing the goose application.\nThe core risk lies in the lack of a comprehensive security inspection mechanism for extension configurations and retry logic within the recipe ingestion pipeline.\nThis allows a malicious actor to bypass intended security controls and execute arbitrary shell commands on the underlying host system, potentially leading to full system compromise, lateral movement within the network, or unauthorized data exfiltration.\nExploitation is contingent upon the user executing a compromised recipe, which can be achieved through social engineering or the distribution of malicious recipe files in collaborative environments.\nThere are no specific authentication requirements for the exploitation if the user interacts with the malicious recipe, as the application itself implicitly trusts the content defined within the extension and retry parameters.",
  "technicalDetails": "The vulnerability resides in the insufficient validation and sanitization of user-supplied configuration parameters within the goose recipe format, specifically targeting the stdio extensions and retry.checks components.\nRoot cause analysis indicates that while the application implements a preliminary security scan for recipes, this scan fails to inspect the content, arguments, or execution parameters associated with extensions and retry logic.\nWhen a recipe is parsed by goose 1.37.0, the application extracts instructions defined within these fields and inadvertently treats them as trusted directives for the system shell.\nThe exploitation flow initiates when a malicious actor embeds shell commands (e.g., using backticks or command substitution syntax) into the stdio extensions field or the retry.checks configuration block of a recipe file.\nUpon execution of the recipe, goose invokes the specified extensions or triggers the retry logic without performing necessary input validation or parameterization. This behavior permits the injection of OS commands, which are subsequently executed with the process identity of the user running goose.\nBecause the security inspection mechanism specifically omits these components from its analysis, the payload bypasses existing integrity checks, granting the attacker a seamless vector for command execution.\nPost-exploitation impact includes the ability for an attacker to establish persistence, drop secondary payloads, or gain unauthorized access to environmental variables and sensitive data accessible to the user context.\nThe vulnerability is inherent to the parsing logic of goose 1.37.0. The lack of strict schema validation for recipe configurations allows for the arbitrary injection of malicious payloads into the system execution chain.\nSince the process runs as the local user, the attacker inherits the full permissions of that user, enabling further unauthorized actions depending on the system's access control configuration."
}