roocode

5 records · 5 with a public proof-of-concept

Disclosed vulnerabilities where the NVD names roocode as an affected vendor, highest CVSS first.

  1. HIGH 8.8CVE-2026-110206public PoC2026-10-13

    Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can s…

    roo code

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 8.8CVE-2026-110205public PoC2026-10-13

    Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match …

    roo code

    AI risk analysis on Exploit-DB.ai →

  3. HIGH 8.8CVE-2026-110204public PoC2026-10-13

    Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can emb…

    roo code

    AI risk analysis on Exploit-DB.ai →

  4. HIGH 8.8CVE-2026-110203public PoC2026-10-13

    Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine(). Attackers can use indirect prompt injection with escaped or single-quoted…

    roo code

    AI risk analysis on Exploit-DB.ai →

  5. HIGH 8.8CVE-2026-110202public PoC2026-10-13

    Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allow…

    roo code

    AI risk analysis on Exploit-DB.ai →