CVE-2026-81833: Code Injection in RooCodeInc Roo-Code

This vulnerability affects the optimizeQuery function in the src/utils/helpers.ts file of the CodeIndexManager component in RooCodeInc Roo-Code up to versions 3.51.1. It allows remote attackers to perform code injection by manipulating inputs to this function. The vendor has archived the project and does not support it anymore, advising against its use. No official fix or patch has been provided, and the vulnerability remains unmitigated in the affected versions. Public exploit code is available, increasing the risk for users who continue to run these versions.

Successful exploitation of this vulnerability allows remote attackers to inject and execute arbitrary code within the affected application. This can lead to unauthorized actions, data compromise, or further system compromise depending on the environment where Roo-Code is deployed. Since the product is no longer supported, affected users cannot rely on vendor patches or updates to mitigate this risk.

No official fix or patch is available as the vendor has archived the project and does not support it. Users are strongly advised to discontinue use of Roo-Code versions 3.51.0 and 3.51.1. If continued use is necessary, consider isolating the application and applying custom mitigations to limit exposure, but note that no vendor-supported remediation exists.