aaif-goose has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 6.5 (medium).
CVEs per month
Last 12 months, by publish date
1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-85623High· 8.8goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection49CVE-2026-109561Medium· 4.2goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode23
aaif-goose vulnerabilities
CVEs affecting aaif-goose, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-109561Medium· 4.2goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode
goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a…
▾ Sunlitaaif-goose · gooseEPSS 0.19%via NVD
CVE-2026-85623High· 8.8goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection
goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe se…
▾ Twilightaaif-goose · gooseEPSS 0.58%via NVD