Priority LOW 36
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position.
CVSS 4.0HIGH 7.7· Network · No auth · User interaction · EPSS 0.00506 · Published 2026-10-13 · No fix listed CWE-436
Priority HIGH 69
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters.
CVSS 4.0HIGH 7.7· Network · No auth · User interaction · EPSS 0.00506 · Published 2026-10-13 · No fix listed CWE-184
Priority HIGH 69
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions.
CVSS 4.0HIGH 7.7· Network · No auth · User interaction · EPSS 0.00506 · Published 2026-10-13 · No fix listed CWE-436
Priority LOW 36
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine().
CVSS 4.0HIGH 7.7· Network · No auth · User interaction · EPSS 0.00506 · Published 2026-10-13 · No fix listed CWE-436
Priority HIGH 69
Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect.
CVSS 4.0HIGH 7.7· Network · No auth · User interaction · EPSS 0.00403 · Published 2026-10-13 · No fix listed CWE-436
Priority MEDIUM 51
Roo Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0119 · Published 2026-03-30 · No fix listed CWE-94
Priority LOW 38
Roo Code is an AI-powered autonomous coding agent that lives in users' editors.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00707 · Published 2025-11-21 · Fixed in 3.26.7 CWE-20
Priority LOW 35
Roo Code is an AI-powered autonomous coding agent that lives in users' editors.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00222 · Published 2025-09-06 · Fixed in 3.26.0 CWE-78
Priority LOW 29
Roo Code is an AI-powered autonomous coding agent that lives in users' editors.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0033 · Published 2025-09-05 · Fixed in 3.26.0 CWE-59
Priority MEDIUM 50
Roo Code is an AI-powered autonomous coding agent that lives in users' editors.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00552 · Published 2025-09-05 · Fixed in 3.26.0 CWE-732
Priority MEDIUM 52
Roo Code is an AI-powered autonomous coding agent that lives in users' editors.
CVSS 4.0CRITICAL 9.9· Network · No auth · No interaction · EPSS 0.0153 · Published 2025-09-05 · Fixed in 3.26.7 CWE-78
Priority LOW 38
Roo Code is an AI-powered autonomous coding agent that lives in users' editors.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00437 · Published 2025-09-05 · Fixed in 3.26.0 CWE-78
Priority HIGH 69
Roo Code is an AI-powered autonomous coding agent that lives in users' editors.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.01126 · Published 2025-07-23 · Fixed in 3.23.19 CWE-77
Priority LOW 39
Roo Code is an AI-powered autonomous coding agent.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00774 · Published 2025-07-07 · Fixed in 3.22.6 CWE-552
Priority LOW 38
Roo Code is an AI-powered autonomous coding agent.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00674 · Published 2025-06-27 · Fixed in 3.20.3 CWE-77
Priority LOW 33
Roo Code is an AI-powered autonomous coding agent.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.005 · Published 2025-06-27 · Fixed in 3.20.3 CWE-74
THREATIST.IORead the docs