Roo Code CVE-2026-110203

Exploitation requires all of the following: (1) the victim runs Roo Code version through 3.54.0 as a VS Code AI coding agent; (2) the auto-approve / command allowlist feature is enabled with permissive allowlisted prefixes such as 'echo'; (3) the agent processes attacker-controlled content (indirect prompt injection) - e.g. a malicious file, repository, issue, tool output, or fetched web page the agent is asked to work on; and (4) a crafted payload uses escaped or single-quoted double quotes to desynchronize the quote-masking regex in parseCommandLine(), hiding command separators behind the allowlisted prefix. Limiting factors that reduce realistic risk: it cannot fire against a default deny-everything setup (the allowlist auto-approve feature must be configured), it needs a prompt-injection delivery channel rather than direct network reach, and it depends on the user actively running the agent over the poisoned content (UI:P). It does NOT require any prior authentication or privileges on the victim system (PR:N).

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 4.0 base score of 7.7 (High) reflects full confidentiality/integrity/availability impact on the vulnerable system (VC:H/VI:H/VA:H) via a network vector with no privileges (AV:N/PR:N), but two metrics materially temper real-world ease: AT:P (a specific attack requirement - the allowlist/auto-approve feature must be enabled with permissive prefixes and the parser desync must be triggered) and UI:P (the victim must run the agent against attacker-controlled content). No EPSS score, SSVC decision, or CISA KEV entry was provided, so exploitation probability cannot be quantified from the input and there is no public exploit identified as such at time of analysis. However, the references include a detailed third-party technical write-up (github.com/7rah/oss-cve/roocode-quote-boundary.md) plus direct links to the vulnerable source lines in parse-command.ts, which lower the bar for building a working exploit. The 'Authentication Bypass' tag is imprecise - this is an authorization/command-approval bypass (CWE-436, Interpretation Conflict), not a login/authentication bypass - so treat that label with caution. Net: a real, exploitable defense-in-depth failure in an AI coding agent that depends on indirect prompt injection and a permissive auto-approve configuration, warranting prompt patching for teams running Roo Code with allowlisted shell prefixes, but with no evidence of mass or active exploitation.

An attacker plants a hidden instruction in content the Roo Code agent will read - a source file, README, issue, or web page fetched during a task - using indirect prompt injection. The payload issues a shell command whose separators are concealed behind an allowlisted prefix like 'echo' by exploiting escaped or single-quoted double quotes that desynchronize the quote-masking regex in parseCommandLine(). A detailed public technical write-up of the quote-boundary desync exists among the references, making reproduction low-effort; the hidden command then auto-approves and executes without the user's consent.