Goose is not affected by this CVE, as it targets only the UI/docs portion, and we are not shipping any of the GUI pieces yet. 

```
rolivier@rdtx ~/W/goose ((v1.36.0))> rg shell-quote
ui/pnpm-lock.yaml
162:      shell-quote:
280:      '@types/shell-quote':
3026:  '@types/shell-quote.5':
6409:  shell-quote.3:
10115:  '@types/shell-quote.5': {}
14255:  shell-quote.3: {}

ui/desktop/package.json
96:    "shell-quote": "^1.8.3",
137:    "@types/shell-quote": "^1.7.5",

documentation/package-lock.json
11080:        "shell-quote": "^1.8.3"
17463:    "node_modules/shell-quote": {
17465:      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz",

ui/desktop/src/components/settings/extensions/utils.ts
3:import { parse as parseShellQuote } from 'shell-quote';
```

No action is required for this CVE.