What happened
Published 2026-10-12 (CVSS 4.2, CWE-863) by VulnCheck. Verified via NVD REST API.
Why it matters
Approval-mode bypasses in agent tools silently defeat the user's explicit 'manual approval' preference, the last human checkpoint before prompt-injected tool actions run.
Attack vector
update_goose_mode never clears persisted read-only annotations; a tool annotated readOnlyHint:true executes without prompting in PermissionInspector::inspect even after the user selects Manual Approval mode, enabling prompt-injected tool calls to run unapproved.
Affected systems
goose (agentic coding tool) 1.28.0 – before 1.44.0
Mitigation
Upgrade goose to 1.44.0 (fix commit b0f4e2a; PR #10528).