Roo Code CVE-2026-110205

Exploitation requires two concrete conditions: (1) Roo Code's auto-approval (command allowlist) feature must be enabled so that commands matching an approved prefix run without a manual prompt; and (2) the attacker must land an indirect prompt injection into content the agent processes (e.g. source files, repository data, web content, or issues) to steer it into emitting a command of the form 'echo *$(...)'. The core flaw is that parseCommandLine() discards command substitutions adjacent to * or ? glob tokens, so the crafted command is evaluated against the allowlist as if only the benign prefix were present. Limiting factors: if auto-approval is disabled the user must manually approve each command and the bypass yields no silent execution; the malicious command must still match a configured allowlisted prefix; and the attacker needs a viable injection channel into the agent's context. Not exploitable against versions after 3.54.0 if the parser is fixed.

Multiple signals point to a genuine but conditionally-gated risk. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H, score 7.7) indicates a network-reachable flaw with no privileges needed but a required attack precondition (AT:P) and passive user interaction (UI:P), which together signal that exploitation is not fully turnkey. No EPSS score is provided in the input, so exploitation-probability cannot be quantified. The CVE is NOT listed in CISA KEV and there is no evidence of active exploitation. However, the references include a dedicated VulnCheck advisory and a GitHub technical writeup (roocode-glob-token.md) that document the exact bypass primitive (echo *$(...)) and the vulnerable source lines in parse-command.ts, so the exploitation technique is effectively public. The practical risk is real for any deployment running Roo Code <=3.54.0 with auto-approval/allowlisting enabled, because the flaw converts an indirect prompt injection into unapproved local command execution (full C/I/A high). It is materially de-prioritized where auto-approval is disabled, since the user then manually approves each command. The AT:P and UI:P metrics are the honest limiters: this is a high-impact flaw gated behind a specific feature state and an injection foothold, not a wormable internet-facing RCE.

A developer uses Roo Code with auto-approval enabled, restricting the agent to an allowlisted command prefix (e.g. echo). An attacker plants indirect prompt-injection content in a file, repository, web page, or issue that the agent reads, instructing it to run a command like 'echo *$(malicious)'; parseCommandLine() discards the command substitution sitting next to the glob character, so the command matches the allowlisted prefix and the hidden substitution executes without user approval. The exact bypass command and vulnerable code lines are publicly documented in the referenced VulnCheck advisory and GitHub writeup.