Roo-Code CVE-2026-81834

Exploitation requires a victim to have Roo-Code version 3.51.1 or earlier installed and to open or process a crafted README file within the extension's context - this is the passive user interaction (UI:P) reflected in the CVSS 4.0 vector. The attacker requires no authentication or system privileges (PR:N). Exploitation is bounded to developer environments where the archived extension remains installed; the shrinking installed base and passive interaction requirement are the primary limiting factors. No special non-default configuration is described as required - any active Roo-Code installation processing untrusted README files is potentially in scope.

The CVSS 4.0 base score of 2.1 is strikingly low for a code injection finding tagged RCE, driven primarily by impact ratings of Low across confidentiality, integrity, and availability combined with a required passive user interaction. A publicly available proof-of-concept on GitHub nominally lowers the exploitation bar, but no CISA KEV listing exists and no confirmed in-the-wild exploitation has been reported. The low impact ceiling deserves independent scrutiny - code injection primitives in terminal execution contexts frequently carry higher real-world impact than formal scoring reflects, and the Low C/I/A ratings have not been independently corroborated. The dominant risk driver is not the CVSS score but the vendor's permanent refusal to patch: RooCodeInc has explicitly archived the repository, meaning installed instances will never receive a fix. Organizations still running Roo-Code are indefinitely exposed, and the existence of a public PoC means the barrier to exploitation is low for any attacker targeting developers in environments where the extension remains installed.

An attacker crafts a repository containing a malicious README file with injected code payloads targeting the ExecaTerminalProcess function, then delivers it to a developer using Roo-Code - for example, via a shared or cloned repository. When the victim's Roo-Code instance processes the README, the injected payload executes in the terminal context without requiring any elevated attacker privileges. A public proof-of-concept is available at the referenced GitHub gist, further lowering the barrier for exploitation against developers who have not uninstalled the extension.