CVE-2026-81834: Code Injection in RooCodeInc Roo-Code
Description
CVE-2026-81834 is a code injection vulnerability in RooCodeInc Roo-Code versions 3.51.0 and 3.51.1, specifically in the ExecaTerminalProcess function of the README File Handler component. The vulnerability allows remote attackers to execute arbitrary code. The product is no longer supported or maintained by the vendor, and the repository has been archived. Exploit code is publicly available. No official patch or remediation is provided by the vendor.
CVSS v4.0
Score 5.3medium
Affected software
RooCodeInc
Roo-Code
cpe:2.3:a:roocodeinc:roo-code:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects RooCodeInc Roo-Code up to versions 3.51.0 and 3.51.1. The flaw exists in the ExecaTerminalProcess function within the README File Handler component, enabling remote code injection through crafted input. The vendor has ceased support and maintenance of Roo-Code, and the repository is archived. Multiple issues were reported previously but remain unpatched. Public exploit code is available, increasing the risk of exploitation. No official fix or remediation guidance is provided.
Potential Impact
Successful exploitation allows remote attackers to inject and execute arbitrary code on affected systems running Roo-Code versions 3.51.0 or 3.51.1. This can lead to compromise of the affected system. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3. Since the product is no longer supported, affected users cannot rely on vendor patches.
Mitigation Recommendations
No official patch or remediation is available as the product is no longer supported by the vendor. Users are advised to discontinue use of Roo-Code and migrate to supported alternatives. Applying network-level protections to restrict access to vulnerable instances may reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-27T14:49:20.043Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a909d01acd9273b49b2d3c4
Added to database: 08/27/2026, 20:24:33 UTC
Last enriched: 09/10/2026, 03:53:09 UTC
Last updated: 10/11/2026, 06:48:19 UTC
Views: 103
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.