Roo Code EUVD-2026-99243

Exploitation requires: (1) Roo Code at or below 3.54.0 with the command auto-approval allowlist feature in use and at least one allowed command target such as echo; (2) the agent ingesting attacker-controlled content so an indirect prompt injection can inject the crafted command; and (3) the developer actively running the agent (UI:P). The specific trigger is a denied command prefixed with a bare >& redirect, which getCommandDecision() strips/evaluates such that the allowlist matches the redirect target while the shell runs the denied command. Limiting factors: the attacker has no direct access to the machine and must get malicious content in front of the agent, the victim must rely on auto-approval, and the issue is addressed in versions after 3.54.0.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H) scores 7.7 (High) and reflects a network-reachable, unauthenticated flaw with full confidentiality, integrity and availability impact on the developer's host, but tempered by two real-world gates: AT:P (a specific attack requirement - the attacker must land an indirect prompt injection) and UI:P (the developer must be running the Roo Code agent). This is not in CISA KEV, so exploitation status is 'no public exploit identified at time of analysis'; however, detailed public technical write-ups exist (VulnCheck advisory plus a GitHub analysis with a direct pointer to the vulnerable getCommandDecision logic in commands.ts), which meaningfully lowers the barrier to reproduction even though no standalone weaponized exploit is flagged in the input. No EPSS score was provided, so statistical exploitation probability cannot be compared against the signals above. Net assessment: a genuine priority for teams actually using Roo Code with command auto-approval allowlists, because it converts the safety allowlist into an attacker-controllable channel for arbitrary command execution; for everyone else the realistic risk is bounded by the need for attacker-controlled content to reach the agent and for the victim to use auto-approval. No signals directly conflict, but note the CWE-436 (interpretation conflict) root cause and the 'Authentication Bypass' tag are a mismatch - this is an approval/authorization bypass, not an authentication bypass.

An attacker plants malicious instructions in content the developer's Roo Code agent will process (for example a GitHub issue, web page, README, or dependency file), relying on indirect prompt injection. The injection issues a denied shell command prefixed with a bare >& redirect pointing at an allowlisted target such as echo, so getCommandDecision() matches the allowlist and auto-approves while the shell actually executes the denied command on the developer's machine. Detailed public technical write-ups describing this redirect-stripping bypass exist, but no standalone weaponized exploit is flagged in the input.