EUVD-2026-74041
GHSA-8fwh-72qq-gr52
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Non-default auto-approve configuration required raises AC:H; attack escapes the approval sandbox justifying S:C; no target-system privileges needed but passive developer interaction required (UI:R).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word immediately followed by a hash character, separator, and denied command to pass the approval gate while bash executes the denied command with the agent's auto-execute privileges on the developer's machine.
AnalysisAI
Roo-Code's auto-approve shell execution mechanism through version 3.54.0 can be bypassed by exploiting a word-boundary mismatch between the approval gate's shell tokenizer and bash, allowing commands explicitly denied in the user's allowlist to execute silently on the developer's machine. An attacker who can influence the command string reaching the auto-execute pipeline - most plausibly via prompt injection through malicious repository content or crafted AI interactions - prefixes a denied command with an allowlisted token followed by a hash character and separator; the approval gate passes the token as safe while bash interprets the hash as a comment delimiter and executes the trailing denied payload with the agent's full privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Roo-Code auto-approve shell execution feature is enabled with a command allowlist configured - this is a deliberate, non-default user configuration, not an out-of-the-box state. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.7 (High) with VC:H/VI:H/VA:H reflects genuine severity because successful exploitation achieves arbitrary command execution on a developer workstation with the AI agent's privileges - a highly impactful outcome. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-confirmed patch version is present in the available data; users should consult the Roo-Code changelog for releases beyond 3.54.0 and monitor the VulnCheck advisory at https://www.vulncheck.com/advisories/roo-code-auto-approve-bypass-via-shell-parser-word-boundary-mismatch for fix confirmation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: disable Roo-Code's auto-approve shell execution feature in developer environments or restrict it to a minimal allowlist that excludes sensitive commands (chmod, rm, git clone from untrusted sources). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-436 – Interpretation Conflict
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today