Roo Code EUVD-2026-99247

Exploitation requires a victim running Roo Code <=3.54.0 with the command auto-approval feature enabled and at least one allowlisted command (e.g., echo) in the approval list - the bypass works by placing a command substitution $(...) in command position so parseCommandLine() only validates the allowlisted token while the shell executes the substituted output. The attacker must also deliver indirect prompt injection through content the agent processes (web pages, repository files, issues, or dependency docs), and the developer must actively operate the agent against that attacker-controlled content (reflected in UI:P and AT:P). Limiting factors: if auto-approval/allowlisting is disabled the approval prompt still fires and the chain breaks, so the non-default allowlist configuration plus required user operation of the agent are the main constraints reducing real-world exposure.

The vendor-supplied CVSS 4.0 base score is 7.7 (High), with AV:N, AC:L, PR:N but tempered by AT:P (a specific attack requirement) and UI:P (passive user interaction), and full VC:H/VI:H/VA:H impact reflecting arbitrary command execution - no scope change to subsequent systems. This is a genuine concern rather than an inflated high-CVSS issue because the vulnerability defeats the product's core security control (the command-approval allowlist), and arbitrary shell execution on a developer's workstation is a high-value outcome. However, several escalating signals are MISSING: there is no EPSS score in the input, no CISA KEV listing (so this is NOT confirmed actively exploited), and no explicit POC=YES flag, though the VulnCheck advisory and a third-party GitHub write-up both describe the exact bypass technique and the description includes a working trigger string ($(echo touch /tmp/x)). The real-world risk is gated by two preconditions that the raw network vector understates: the victim must have command auto-approval configured with an allowlisted command such as echo, and the victim must operate the agent on attacker-controlled content - so exploitation is realistic but not spray-and-pray. Net assessment: a credible, actionable priority for teams running Roo Code <=3.54.0 with auto-approve enabled, but absent KEV/EPSS data the likelihood of mass exploitation cannot be confirmed and appears conditional rather than wormable.

An attacker seeds malicious instructions into content a Roo Code agent will read - a web page, source file, dependency README, or issue tracker entry - using indirect prompt injection. When the developer runs the agent against that content with command auto-approval enabled, the injected instruction asks the agent to run a command like $(echo malicious-payload); parseCommandLine() sees only the allowlisted echo and auto-approves, but the shell performs the command substitution and executes the attacker's output without the user ever confirming. A public write-up and the VulnCheck advisory document the technique, though no weaponized exploit tool is confirmed in the provided data.