Publication of a 0-day PoC for the popular AI agent Goose AI

For informational purposes only

Vulnerability type: RCE via deep link goose://recipe

Goose is an open-source AI agent that runs on the user's computer and connects to various language models, including GPT, Claude, Gemini, and local models via Ollama. Unlike a regular chatbot, it can independently read and modify files, run commands and tests, and interact with external services through MCP.

According to the attacker, when a link containing a malicious configuration is opened, the application launches extension child processes before the user sees the confirmation window. This is possible because the deny_if_malicious_cmd_args function uses a “fail-open” approach (allow if uncertain). If it does not recognize the ecosystem (for example, if the command does not start with npx or uvx), it simply logs “Unknown ecosystem” and returns Ok(()), allowing execution. The GOOSE_ALLOWLIST allowlist is checked only during regular extension installation, but is completely ignored when creating a session via recipe.