EUVD-2026-74040
GHSA-cvxc-67pr-wffj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Auto-approve must be enabled with a configured allowlist (AC:H); attacker content must be processed by the user (UI:R); full developer-system impact when exploited (S:C, C/I/A:H).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line with an allowlisted prefix followed by the stderr-redirecting pipe operator and a denied command, causing the parser to approve the full pipeline while bash executes the denied component with the agent's auto-execute privileges on the developer's machine.
AnalysisAI
Command allowlist bypass in Roo-Code through version 3.54.0 enables execution of shell commands that users explicitly denied from auto-approval. The vulnerability stems from the shell command parser's failure to recognize the bash pipe operator |& as a command separator - a crafted pipeline prefixed with an allowlisted command followed by the stderr-redirecting pipe and a denied command passes parser validation while bash executes the entire pipeline, including the denied component, with full agent privileges on the developer's workstation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following to be true simultaneously: Roo-Code version 3.54.0 or earlier installed as a VS Code extension; the auto-approve/auto-execute shell command feature enabled by the developer; at least one command prefix present on the configured allowlist; and the developer's default shell must be bash or a compatible shell that interprets `|&` as a pipe operator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.7 (AV:N/AC:L/AT:P/PR:N/UI:P) reflects meaningful but conditional risk: the auto-execute feature must be enabled and a command allowlist configured (AT:P), and the user must process attacker-supplied content through the agent (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No specific patched version number is confirmed in the available input data - monitor the Roo-Code changelog and the VulnCheck advisory at https://www.vulncheck.com/advisories/roo-code-auto-approve-bypass-via-shell-command-pipe-operator for a confirmed fix release beyond 3.54.0 and upgrade immediately upon availability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your organization's Roo-Code deployment to identify all installations running version 3.54.0 or earlier, and disable auto-approval features if your configuration supports it; alert development teams to manually review all shell commands pending a vendor security update. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today