EUVD-2026-74041
GHSA-8fwh-72qq-gr52
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker embeds prompt injection in malicious repo content
-
DeliveryDeveloper opens repo in Roo-Code with auto-approve enabled
-
ExploitAgent generates crafted command with allowlisted prefix and hash separator
-
ExecutionApproval gate misclassifies token as safe
-
PersistBash interprets hash as comment boundary
-
ImpactDenied trailing command executes with agent privileges on developer machine
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Interpretation consistency
|
| Exploitation Conditions | Exploitation requires that the Roo-Code auto-approve shell execution feature is enabled with a command allowlist configured - this is a deliberate, non-default user configuration, not an out-of-the-box state. The attacker must additionally control or influence the command string reaching the auto-execute pipeline; the most plausible delivery mechanism is prompt injection through untrusted content processed by the agent (malicious repository files, crafted code comments, or adversarial AI responses). The attack does not require the developer to take an explicit approval action - only passive use of the agent while auto-approve is active (UI:P). Exploitation is strictly limited to Roo-Code ≤3.54.0; users running Roo-Code with full manual approval for all shell commands are not affected regardless of version. |
| Impact | The CVSS 4.0 score of 7.7 (High) with VC:H/VI:H/VA:H reflects genuine severity because successful exploitation achieves arbitrary command execution on a developer workstation with the AI agent's privileges - a highly impactful outcome. AT:P (attack requirements present) is the principal risk-limiting factor: the auto-approve shell execution feature with a configured allowlist must be deliberately enabled by the user, which is a non-default workflow. UI:P (passive user interaction) indicates the developer need not take an explicit approval action beyond simply having the agent running. The GitHub-hosted technical writeup from the original discoverer provides detailed implementation specifics that meaningfully compress the time-to-exploit for motivated attackers, even absent a standalone PoC binary. EPSS data is not provided, and the CVE is absent from CISA KEV, so observed in-the-wild exploitation probability is unconfirmed. The most credible threat model is prompt injection: a developer running Roo-Code with auto-approve enabled on an untrusted repository could be exploited without any deliberate action. Users with manual approval enabled for all commands are entirely unaffected by this vulnerability. |
| Exploit ScenarioDerived | A developer running Roo-Code ≤3.54.0 with auto-approve enabled on an allowlist that includes |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Roo-Code's auto-approve shell execution mechanism through version 3.54.0 can be bypassed by exploiting a word-boundary mismatch between the approval gate's shell tokenizer and bash, allowing commands explicitly denied in the user's allowlist to execute silently on the developer's machine. An attacker who can influence the command string reaching the auto-execute pipeline - most plausibly via prompt injection through malicious repository content or crafted AI interactions - prefixes a denied command with an allowlisted token followed by a hash character and separator; the approval gate passes the token as safe while bash interprets the hash as a comment delimiter and executes the trailing denied payload with the agent's full privileges. No public exploit has been confirmed as actively exploited (not in CISA KEV), though a detailed technical writeup is publicly available on GitHub, lowering the barrier for exploitation.
RemediationAI
No vendor-confirmed patch version is present in the available data; users should consult the Roo-Code changelog for releases beyond 3.54.0 and monitor the VulnCheck advisory at https://www.vulncheck.com/advisories/roo-code-auto-approve-bypass-via-shell-parser-word-boundary-mismatch for fix confirmation. As an immediate compensating control, disable the auto-approve shell execution feature entirely - this eliminates the vulnerable approval gate from the command execution path and requires manual confirmation for each shell command (trade-off: increased friction in AI-assisted development workflows). If auto-approve is operationally required, restrict Roo-Code usage to controlled environments that process only fully trusted content - avoiding open-source repositories, user-supplied inputs, or external web content - to remove the prompt injection delivery channel (trade-off: significantly reduced utility for open-source development). Do not treat allowlist configuration alone as a security boundary given this parser differential.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Roo-Code is an AI-powered coding agent, typically deployed as a VS Code extension, that offers an auto-approve feature permitting certain shell commands to execute without manual user confirmation based on a configured allowlist. CWE-436 (Interpretation Conflict) precisely describes the root cause: the approval gate's shell parser and bash apply incompatible word-boundary semantics around the hash character. The approval gate's tokenizer classifies the hash as a word-boundary character and evaluates only the preceding allowlisted token as the command, passing it; bash, however, treats the hash as the beginning of an inline comment, meaning everything after the allowlisted token up to and including the hash is discarded as a comment, and the subsequent separator and denied command are executed normally. This dual-parser discrepancy pattern - where security logic and execution logic disagree on token boundaries - is structurally analogous to HTTP request smuggling and Unicode normalization bypasses. No CPE string is provided in the available data; the affected version range is ≤3.54.0 per EUVD-2026-74041.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Non-default auto-approve configuration required raises AC:H; attack escapes the approval sandbox justifying S:C; no target-system privileges needed but passive developer interaction required (UI:R).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word immediately followed by a hash character, separator, and denied command to pass the approval gate while bash executes the denied command with the agent's auto-execute privileges on the developer's machine.
Executive ViewAI
Roo-Code versions through 3.54.0 contain a shell execution bypass in the auto-approval mechanism that allows attackers to execute explicitly denied commands with agent privileges through prompt injection attacks targeting developers using the tool. Compromise of developer machines could lead to unauthorized code execution, credential theft, or supply-chain attacks via build systems or repository access.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or restrict auto-approve shell execution to a minimal command whitelist, require explicit manual approval for all shell commands regardless of user allowlist, isolate Roo-Code agent processes with restricted filesystem and network permissions, monitor for process execution anomalies, and review all cloned repositories for suspicious content before processing with Roo-Code.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB