Roo-Code CVE-2026-81835

Exploitation requires that Roo-Code's MCP integration is active and that the targeted user connects the extension to an attacker-controlled MCP server endpoint - either through direct configuration, a malicious project file specifying a server URI, or social engineering. The CVSS PR:L metric confirms some level of authenticated or at-minimum application-level access is required (the user must be operating Roo-Code with MCP enabled). The UI:P metric confirms user interaction is necessary - specifically, the user must initiate or accept a connection to the malicious server, making fully passive exploitation not feasible. Exploitation is limited to users still actively running Roo-Code version 3.51.1 or earlier; no special OS privilege, elevated account, or non-default system configuration beyond having the extension installed and MCP enabled is required on the client side. The attacker must control or compromise a reachable MCP server.

The CVSS 4.0 base score of 5.1 (Medium) reflects the realistic constraint profile: AV:N indicates network reachability, but PR:L (low privileges) and UI:P (user interaction required) significantly reduce exploitability compared to a fully unauthenticated, zero-click flaw. The E:P (proof-of-concept) supplemental metric confirms exploit code is publicly available, elevating practical risk above a theoretical vulnerability. Impact metrics VC:L/VI:L/VA:L with no subsequent-system scope change (SC:N/SI:N/SA:N) indicate contained, limited damage per successful exploitation rather than critical system compromise. The most material risk amplifier is the permanent absence of any patch: the vendor has archived the repository and explicitly refuses to remediate, making every deployed instance indefinitely vulnerable. Prevalence is assessed as low - Roo-Code is a niche, now-abandoned AI coding extension - which limits aggregate exposure. No CISA KEV listing is present, suggesting exploitation has not been confirmed at scale as of analysis time. The combination of low footprint, low-to-moderate CVSS, and limited impact metrics means this is a low-to-medium organizational priority, elevated primarily for teams actively running Roo-Code in production.

An attacker hosts a malicious MCP server and induces a Roo-Code user - through phishing, a compromised MCP server registry entry, or a crafted project configuration - to connect the extension to that server. When the fetch_instructions function retrieves instructions from the attacker-controlled endpoint, the injected payload executes within the Roo-Code process context, granting the attacker code execution with the privileges of the developer running the extension. A proof-of-concept demonstrating this technique is publicly available on GitHub.