Roo-Code versions up to 3.54.0 have a command approval bypass vulnerability in the parseCommandLine() function. This flaw allows attackers to execute arbitrary shell commands by using command substitution syntax in command position, bypassing the intended approval mechanism. Indirect prompt injection can be used to submit commands that evade the echo allowlist check, leading to unauthorized shell command execution.
Roo-Code versions up to 3.54.0 have a command approval bypass vulnerability in the parseCommandLine() function. This flaw allows attackers to use indirect prompt injection with crafted commands containing glob characters and command substitutions, bypassing user approval when auto-approval is enabled.
Roo-Code versions up to 3.54.0 have a command approval bypass vulnerability. This flaw allows attackers to execute shell commands that should be denied because the parseCommandLine() function incorrectly treats certain command substitutions as parameter expansions. Attackers can exploit this via indirect prompt injection by embedding denied commands inside allowed commands such as echo, enabling execution without user approval on bash 5.3+ or ksh93 environments.
Roo-Code versions up to 3.54.0 have a command approval bypass vulnerability. This flaw allows attackers to bypass user approval for shell commands by exploiting a quote-masking regex in the parseCommandLine() function. Specifically, attackers can use indirect prompt injection with escaped or single-quoted double quotes to conceal command separators behind allowlisted prefixes such as echo, leading to unauthorized command execution.
Roo Code versions up to 3.54.0 have a command approval bypass vulnerability in the getCommandDecision() function. This flaw allows attackers to prefix denied shell commands with a bare >& redirect, causing the commands to be auto-approved and executed. Indirect prompt injection can be used to manipulate the allowlist to match a redirect target such as echo, while the shell executes the originally denied command on the developer's machine. The vulnerability has a high severity score of 7.7.
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word immediately followed by a hash character, separator, and denied command to pass the approval gate while bash executes the denied command with the agent's auto-execute privileges on the developer's machine.
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line with an allowlisted prefix followed by the stderr-redirecting pipe operator and a denied command, causing the parser to approve the full pipeline while bash executes the denied component with the agent's auto-execute privileges on the developer's machine.
CVE-2026-81837 is a path traversal vulnerability in RooCodeInc Roo-Code affecting versions 3.51.0 and 3.51.1. The flaw exists in the path.resolve function within the ApplyPatchTool component, allowing remote attackers to manipulate file paths. The product is no longer supported or maintained by the vendor, and the repository has been archived. An exploit has been published, but no official patch or remediation is available.
CVE-2026-81836 is a medium severity vulnerability in RooCodeInc Roo-Code up to version 3.51.1. It involves cleartext transmission of sensitive information in the OAuth Callback component. The vulnerability requires high attack complexity and no user interaction, with no privileges needed. Exploit code is publicly available, but the product is no longer supported or maintained by the vendor.
CVE-2026-81835 is a medium severity code injection vulnerability in RooCodeInc Roo-Code versions 3.51.0 and 3.51.1. It affects the fetch_instructions function in the malicious_mcp_server.py file within the MCP Integration Trust Model component. The vulnerability allows remote attackers to inject code. The product is no longer supported by the vendor, who has archived the repository and does not encourage use of the software.
CVE-2026-81834 is a code injection vulnerability in RooCodeInc Roo-Code versions 3.51.0 and 3.51.1, specifically in the ExecaTerminalProcess function of the README File Handler component. The vulnerability allows remote attackers to execute arbitrary code. The product is no longer supported or maintained by the vendor, and the repository has been archived. Exploit code is publicly available. No official patch or remediation is provided by the vendor.
CVE-2026-81833 is a code injection vulnerability in RooCodeInc Roo-Code versions 3.51.0 and 3.51.1. The flaw exists in the optimizeQuery function within the CodeIndexManager component, allowing remote attackers to inject code. The product is no longer supported or maintained by the vendor, and no official patch or remediation is available. Exploit code has been publicly released, but there are no confirmed reports of active exploitation in the wild. The vulnerability has a medium severity rating with a CVSS score of 5.1.
Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter expansions with opaque placeholders before extracting command substitutions, causing the containsDangerousSubstitution guard to miss nested payloads, which are then auto-approved based on the outer allowlisted command prefix and executed by the shell via execa, enabling arbitrary command execution.
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list prefixes. This issue has been patched in version 3.26.7.
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle scripts, if a repository’s package.json file contains a malicious postinstall script, it would be executed automatically without user approval. This means that enabling auto-approved commands and opening a malicious repo could result in arbitrary code execution. This is fixed in version 3.26.0.
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where .rooignore protections could be bypassed using symlinks. This allows an attacker with write access to the workspace to trick the extension into reading files that were intended to be excluded. As a result, sensitive files such as .env or configuration files could be exposed. An attacker able to modify files within the workspace could gain unauthorized access to sensitive information by bypassing .rooignore rules. This could include secrets, configuration details, or other excluded project data. This is fixed in version 3.26.0.
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where certain VS Code workspace configuration files (.code-workspace) are not protected in the same way as the .vscode folder. If the agent was configured to auto-approve file writes, an attacker able to influence prompts (for example via prompt injection) could cause malicious workspace settings or tasks to be written. These tasks could then be executed automatically when the workspace is reopened, resulting in arbitrary code execution. This issue is fixed in version 3.26.0.
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request metadata in a privileged context, allowing an attacker to craft malicious input and achieve Remote Code Execution (RCE) on the Actions runner. The workflow runs with broad permissions and access to repository secrets. It is possible for an attacker to execute arbitrary commands on the runner, push or modify code in the repository, access secrets, and create malicious releases or packages, resulting in a complete compromise of the repository and its associated services. This is fixed in version 3.26.7.
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent was configured to auto-approve execution of certain commands, an attacker able to influence prompts could abuse this weakness to execute additional arbitrary commands alongside the intended one. This is fixed in version 3.26.0.