Roo-Code EUVD-2026-67286

The ApplyPatchTool feature must be active and reachable over the network, which reflects Roo-Code's intended operation as a network-accessible AI coding assistant. The CVSS 4.0 vector PR:N confirms no authentication is required. UI:P indicates some form of passive user interaction is involved (e.g., a user must trigger a patch operation or open a session), limiting fully autonomous exploitation. Exploitation requires that path traversal sequences in patch input reach the path.resolve call without prior sanitization - no special non-default configuration is needed beyond the product simply being installed and running. Limiting factors include the requirement for passive user interaction (UI:P) and low rather than high impact metrics, meaning exploitation yields partial file access rather than full system compromise. The product being end-of-life limits its current deployment footprint, reducing the effective attack surface.

The CVSS 4.0 score of 5.3 (Medium) reflects network reachability with low complexity and no privileges, but the impact is capped at Low across confidentiality, integrity, and availability - consistent with a path traversal that allows partial file access rather than full remote code execution. The E:P (Proof of Concept) supplemental metric acknowledges the published exploit. EPSS data is not provided, but the absence of a CISA KEV listing suggests no confirmed widespread active exploitation at time of analysis. The most material risk signal here is operational: the vendor has explicitly abandoned the project, so this vulnerability will never receive a fix. Organizations running Roo-Code face permanent, unpatched exposure. Despite the moderate CVSS score, the combination of a public exploit, network-reachable attack surface, no authentication requirement, and a permanent no-fix status elevates real-world urgency for any deployment still in use.

An unauthenticated remote attacker sends a crafted patch request to a running Roo-Code instance containing directory traversal sequences in the file path parameter processed by ApplyPatchTool. The path.resolve call resolves the traversal sequences without sanitization, allowing the attacker to read sensitive files (e.g., ~/.ssh/id_rsa, environment files) or write arbitrary content to locations outside the project directory. A proof-of-concept demonstrating this technique is publicly available on GitHub Gist.