Roo Code CVE-2026-110204

Exploitation requires three concrete conditions drawn from the description: (1) the victim's environment uses bash 5.3+ or ksh93, because only those shells interpret the ${ command; } function-substitution (funsub) syntax that parseCommandLine() misparses as a parameter expansion; (2) Roo Code's auto-approve/allowlist feature must permit at least one command (e.g., echo) into which the denied command is embedded; and (3) the user must engage the agent on attacker-controlled content so the indirect prompt injection reaches the command parser (UI:P). Limiting factors: environments on older bash (<5.3) or non-ksh93 shells are not vulnerable to this specific funsub misparse, and no auto-approved allowlisted command means the injected command still hits the approval prompt. No authentication to a remote service is needed (PR:N), but the per-host shell-version dependency (AT:P) meaningfully narrows the exploitable population.

This is a moderate-to-high priority issue in a specific context rather than a mass-exploitation emergency. The CVSS 4.0 base score is 7.7 with vector AV:N/AC:L/AT:P/PR:N/UI:P and full high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H), reflecting that a successful bypass yields arbitrary shell command execution on the developer's host. Two metrics temper the raw score: AT:P (the attack has a precondition - the victim must be running bash 5.3+ or ksh93, the shells whose funsub/${ command; } handling the parser misinterprets) and UI:P (the victim must be actively using Roo Code on attacker-influenced content). It is NOT in CISA KEV, so there is no confirmed active exploitation. No EPSS score was supplied in the input, so probabilistic exploitation likelihood could not be weighed. A public technical writeup exists (the oss-cve 'funsub' markdown and the VulnCheck advisory), which documents the exact vulnerable code lines, so the barrier to reproduction is low even though no weaponized in-the-wild tooling is confirmed. SIGNAL CONFLICT TO NOTE: the input Tag labels this 'Authentication Bypass,' but the description and CWE-436 (Interpretation Conflict) describe a command-approval/allowlist bypass, not credential authentication bypass - treat the tag with caution. Net: a realistic risk for organizations running Roo Code with auto-approve allowlists on modern bash/ksh93, but gated by the shell-version requirement and the need for the user to process attacker-controlled content.

An attacker plants indirect prompt-injection content (e.g., in a repository file, issue, web page, or documentation the AI agent reads) that instructs Roo Code to run an allowlisted command such as echo with a denied command embedded as a ${ rm -rf ...; } function-substitution. Because parseCommandLine() misclassifies the funsub as a harmless parameter expansion, the approval gate passes and the embedded command executes on bash 5.3+ or ksh93 without user approval. A public technical writeup demonstrating the parser flaw exists, lowering the effort to reproduce.