Which versions of Roo Code are affected by EUVD-2026-46065?

Roo Code AI coding agent through version 3.54.0 is vulnerable to command execution attacks that bypass built-in safety mechanisms, potentially compromising code integrity and system security across…

Is there a public PoC exploit available for EUVD-2026-46065?

Yes, a public proof-of-concept exploit is available for EUVD-2026-46065. Prioritise patching immediately. EPSS: 1.9%.

How to fix or mitigate EUVD-2026-46065?

Within 24 hours, identify all systems running Roo Code versions up to 3.54.0 and document their role in development and CI/CD pipelines. Within 7 days, disable the auto-approve execute feature across all deployments and require manual approval workflows before any command execution. Within 30 days, either apply a vendor patch when released, migrate to alternative tools with stronger security controls, or deploy Roo Code exclusively in isolated sandboxed environments with restricted network access and comprehensive command execution logging.

Roo Code EUVD-2026-46065

Q: What is the CVSS score of EUVD-2026-46065?

EUVD-2026-46065 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.9%.

| CVE-2026-63108 HIGH

Incomplete List of Disallowed Inputs (CWE-184)

2026-07-20 VulnCheck

GHSA-5xxh-cfjg-qm65

Command Injection Roo Code Roocodeinc

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

AC:H and UI:R because exploitation needs auto-approve enabled with an allowlist plus user-driven agent action; PR:N as no victim-system authentication is required, with full local C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 19:21 vuln.today

CVE Published

Jul 20, 2026 - 18:24 cve.org

HIGH 7.7

DescriptionCVE.org

Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter expansions with opaque placeholders before extracting command substitutions, causing the containsDangerousSubstitution guard to miss nested payloads, which are then auto-approved based on the outer allowlisted command prefix and executed by the shell via execa, enabling arbitrary command execution.

AnalysisAI

Arbitrary command execution in Roo Code (the open-source AI coding agent) through version 3.54.0 lets attackers slip past the auto-approve execute feature's allowlist/denylist by hiding command substitutions inside shell parameter-expansion defaults. Because the parser replaces parameter expansions with opaque placeholders before scanning for dangerous substitutions, a payload built from an allowlisted prefix carrying a nested $(...) is judged safe, auto-approved on the outer command, and executed by the shell via execa. A public PoC and technical write-up exist (reported by VulnCheck); there is no confirmed active exploitation (not in CISA KEV) and no EPSS score was provided.

Technical ContextAI

Roo Code is a VS Code AI coding-assistant extension that can propose and run shell commands, gated by a user-configurable allowlist/denylist in its auto-approve execute feature. The flaw lives in parse-command.ts: to normalize a command line it first substitutes shell parameter expansions (e.g. ${VAR:-default}) with opaque placeholders, then separately extracts command substitutions ($(...) and backticks) for its containsDangerousSubstitution guard. Because the placeholder step runs first, any command substitution nested inside a parameter-expansion default is masked and never seen by the guard, so only the benign outer command prefix is evaluated for approval. This is a textbook CWE-184 (Incomplete List of Disallowed Inputs / incomplete denylist): the safety check operates on a sanitized representation that no longer reflects what the shell, via execa, will ultimately expand and execute.

RemediationAI

Upgrade to a Roo Code release later than 3.54.0 that corrects the parse-command.ts placeholder ordering; however, the available data does not name a confirmed fixed version, so verify the patched release directly against the VulnCheck advisory (https://www.vulncheck.com/advisories/roo-code-command-injection-via-parameter-expansion-parsing) before relying on an upgrade - upstream fix status is not independently confirmed from the provided data. As immediate compensating controls, disable the auto-approve execute feature so every proposed command requires explicit human review (trade-off: loses the automation convenience the feature provides), or empty/severely tighten the command allowlist so no prefix is auto-approved (trade-off: more approval prompts and slower workflows). Additionally, run Roo Code only against trusted repositories and prompts to reduce the chance of attacker-controlled content reaching the executor, and use the write-up at https://github.com/geo-chen/oss/blob/main/Roo-Code.md to build detection for nested command-substitution patterns.