Roo Code: five unpatched CVEs let crafted shell commands slip past auto-approve

Vulnerability · Roo Code · HIGH

Incident dateNot stated

DisclosedOct 13, 2026 (NVD and GitHub advisories, all five CVEs). No fix; repository archived, last release 3.54.0 on May 15, 2026.

Added hereOct 14, 8:20 AM ET

Last verifiedOct 14, 2026

Summary

NVD published five CVEs from VulnCheck for Roo Code, an AI coding agent for VS Code. Each one is a way to make a denied shell command look like an allowlisted one, such as echo, so Roo Code runs it without asking when auto-approve is on. All five affect Roo Code through 3.54.0. The GitHub repository is archived and 3.54.0 is the last release, so no fix is expected. NVD tags all five as unsupported when assigned. VulnCheck scores each 7.7 High (CVSS 4.0) and 8.8 High (CVSS 3.1).

Severity

HIGH Commands run on the developer's machine without approval, triggered through indirect prompt injection, for example text in a file or web page the agent reads. Scored 7.7 High (CVSS 4.0) and 8.8 High (CVSS 3.1) by VulnCheck. Only matters when command auto-approve is enabled, but there is no patch.

Timeline

May 15, 2026
Roo Code v3.54.0 released on GitHub. It is the latest release, and the repository is now archived.
Oct 13, 2026 (NVD)
CVE-2026-110202: a bare >& redirect prefix makes the allowlist match the redirect target (such as echo) while the shell runs the denied command.
Oct 13, 2026 (NVD)
CVE-2026-110203: escaped or single-quoted double quotes confuse the quote-masking regex in parseCommandLine(), hiding command separators behind an allowlisted prefix.
Oct 13, 2026 (NVD)
CVE-2026-110204: parseCommandLine() treats ${ command; } substitutions as parameter expansions, so a denied command inside echo runs on bash 5.3+ or ksh93.
Oct 13, 2026 (NVD)
CVE-2026-110205: command substitutions placed next to * or ? glob characters, as in echo *$(...), are dropped by the parser but still run.
Oct 13, 2026 (NVD)
CVE-2026-110206: a command substitution in command position, such as $(echo touch /tmp/x), passes the echo check and the shell then runs its output.
Oct 13, 2026
GitHub publishes matching advisories GHSA-v45q-xfmj-r4wr, GHSA-c42p-7mq6-q83w, GHSA-mfc9-vhw7-f5w9, GHSA-66pw-2qq8-258w and GHSA-r2h8-r3xm-p2rm, all rated high.

How it happened

Roo Code decides whether to auto-approve a command by parsing it in its own code (parseCommandLine() and getCommandDecision()) and matching the result against an allowlist. The shell does not always read the command the same way. Each CVE is a case where the two disagree, so the check sees an allowed command like echo and the shell runs something else. NVD lists all five as CWE-436 (Interpretation Conflict). The researcher's write-ups are linked from NVD. To be fair to the project: these were assigned after the repository was archived, which is why NVD marks them unsupported when assigned and why the maintainers have not shipped a fix.

How to check your app

In VS Code, open the Extensions view and check whether Roo Code is installed, and which version. Every version through 3.54.0 is affected and there is no newer one.
In Roo Code's settings, check whether auto-approve for command execution is turned on. If it is, turn it off so every shell command needs your approval.
Do not rely on the allowed-commands list to keep you safe. All five bugs make a denied command look like an allowed one.
If you keep using it, be careful pointing it at repositories, issues, docs or web pages you did not write, since that is how a prompt injection gets in.
Plan a move to a maintained coding agent that still ships security fixes, and remove Roo Code once you have.

Sources

Corrections and updates

None. Re-checked against every source on Oct 14, 2026.

If you want someone to check your own app for problems like this, LockedVibe, which has the same owner as this site, lists its security scans on its pricing page. Disclosure.