Skip to main content

Roo Code CVE-2026-63108

| EUVDEUVD-2026-46065 HIGH
Incomplete List of Disallowed Inputs (CWE-184)
2026-07-20 VulnCheck GHSA-5xxh-cfjg-qm65
Command Injection Roo Code
7.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

AC:H and UI:R because exploitation needs auto-approve enabled with an allowlist plus user-driven agent action; PR:N as no victim-system authentication is required, with full local C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 20, 2026 - 19:21 vuln.today
CVE Published
Jul 20, 2026 - 18:24 cve.org
HIGH 7.7

DescriptionCVE.org

Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter expansions with opaque placeholders before extracting command substitutions, causing the containsDangerousSubstitution guard to miss nested payloads, which are then auto-approved based on the outer allowlisted command prefix and executed by the shell via execa, enabling arbitrary command execution.

AnalysisAI

Arbitrary command execution in Roo Code (the open-source AI coding agent) through version 3.54.0 lets attackers slip past the auto-approve execute feature's allowlist/denylist by hiding command substitutions inside shell parameter-expansion defaults. Because the parser replaces parameter expansions with opaque placeholders before scanning for dangerous substitutions, a payload built from an allowlisted prefix carrying a nested $(...) is judged safe, auto-approved on the outer command, and executed by the shell via execa. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Plant nested-substitution payload in agent-visible content
Delivery
Victim's Roo Code proposes allowlisted-prefix command
Exploit
Parser masks parameter expansion, guard misses payload
Execution
Auto-approve clears outer command
Persist
execa runs hidden substitution
Impact
Arbitrary code execution on developer host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target to be running Roo Code at or below 3.54.0 with the auto-approve execute feature enabled and at least one allowlisted command prefix configured; the payload must nest a command substitution ($(...) or backticks) inside a shell parameter-expansion default (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H, score 7.7) captures a network-reachable path to full confidentiality/integrity/availability compromise but tempers it with AT:P (a specific attack requirement) and UI:P (passive user interaction), meaning exploitation is not turnkey. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A developer runs Roo Code with auto-approve execute enabled and a benign prefix such as 'echo' allowlisted, then directs it to work on an attacker-influenced repository, issue, or prompt. The agent is steered to emit an allowlisted-prefix command carrying a nested command substitution inside a parameter-expansion default; the guard approves the harmless-looking outer command while the shell expands and runs the hidden payload, yielding arbitrary code execution on the developer's machine. …
Remediation Upgrade to a Roo Code release later than 3.54.0 that corrects the parse-command.ts placeholder ordering; however, the available data does not name a confirmed fixed version, so verify the patched release directly against the VulnCheck advisory (https://www.vulncheck.com/advisories/roo-code-command-injection-via-parameter-expansion-parsing) before relying on an upgrade - upstream fix status is not independently confirmed from the provided data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running Roo Code versions up to 3.54.0 and document their role in development and CI/CD pipelines. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Roo Code

View all
CVE-2025-53536 HIGH
8.1 Jul 07

Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker
CVE-2025-53098 HIGH
8.1 Jun 27

Roo Code is an AI-powered autonomous coding agent. The project-specific MCP configuration for the Roo Code agent is stor
CVE-2025-53097 MEDIUM
5.9 Jun 27

A security vulnerability in Roo Code (CVSS 5.9). Remediation should follow standard vulnerability management procedures.
CVE-2025-65946 HIGH
8.1 Nov 21

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Rated high severity (CVSS 8.1), this vul
CVE-2025-58374 HIGH
7.8 Sep 06

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Rated high severity (CVSS 7.8), this vul
CVE-2025-58373 MEDIUM
5.5 Sep 05

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Rated medium severity (CVSS 5.5), this v
CVE-2025-58372 HIGH
8.1 Sep 05

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Rated high severity (CVSS 8.1), this vul
CVE-2025-58371 CRITICAL
9.9 Sep 05

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Rated critical severity (CVSS 9.9), this
CVE-2025-58370 HIGH
8.1 Sep 05

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Rated high severity (CVSS 8.1), this vul

Same weakness CWE-184 – Incomplete List of Disallowed Inputs

View all
CVE-2026-34415 CRITICAL POC
9.3
CVE-2026-41264 CRITICAL POC
9.2
CVE-2024-5217 CRITICAL POC
9.2
CVE-2023-2017 HIGH POC
8.8
CVE-2023-29003 HIGH POC
8.8
CVE-2021-25631 HIGH POC
8.8
CVE-2018-6383 HIGH POC
8.8
CVE-2015-5946 HIGH POC
7.8

Same technique Command Injection

View all
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6

Share

CVE-2026-63108 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy