Roocodeinc
Monthly
Arbitrary command execution in Roo Code (the open-source AI coding agent) through version 3.54.0 lets attackers slip past the auto-approve execute feature's allowlist/denylist by hiding command substitutions inside shell parameter-expansion defaults. Because the parser replaces parameter expansions with opaque placeholders before scanning for dangerous substitutions, a payload built from an allowlisted prefix carrying a nested $(...) is judged safe, auto-approved on the outer command, and executed by the shell via execa. A public PoC and technical write-up exist (reported by VulnCheck); there is no confirmed active exploitation (not in CISA KEV) and no EPSS score was provided.
Path traversal in RooCodeInc Roo-Code through version 3.51.1 allows remote unauthenticated attackers to read and write files outside the intended working directory by manipulating input processed by the path.resolve function in ApplyPatchTool.ts. The vendor has confirmed they archived the repository and discontinued all support, meaning no patch will ever be released. Publicly available exploit code exists via a GitHub Gist, and no vendor-released patch identified at time of analysis - organizations still running this tool are permanently exposed.
Cleartext transmission of OAuth credentials in RooCodeInc Roo-Code up to version 3.51.1 exposes sensitive OAuth tokens to interception via the OAuth callback handler in src/integrations/claude-code/oauth.ts. The vendor has officially archived the repository and explicitly discourages continued use, meaning no patch will be issued. A public proof-of-concept is available on GitHub, though high attack complexity (requiring a network interception position) constrains opportunistic exploitation.
Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote low-privileged attacker to execute injected code via the `fetch_instructions` function within the MCP (Model Context Protocol) Integration Trust Model component (`malicious_mcp_server.py`). A publicly available proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly confirmed the product is no longer maintained - the repository is archived - meaning no patch will ever be released, permanently leaving all deployed instances vulnerable.
Code injection in RooCodeInc Roo-Code through version 3.51.1 allows remote attackers to execute arbitrary code via the ExecaTerminalProcess function in the README File Handler, triggered by passive user interaction with a crafted README file. The vendor has explicitly archived the repository and confirmed no patch will be issued, leaving all installed instances permanently unpatched. A public proof-of-concept exploit is available on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 2.1 reflects limited impact ratings across all three CIA pillars.
Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote, low-privileged attacker with passive user interaction to inject and execute arbitrary code via the `optimizeQuery` function in the CodeIndexManager component (`src/utils/helpers.ts`). A public proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly archived the repository and will not issue a patch, leaving all users of this product permanently unpatched.
Arbitrary command execution in Roo Code (the open-source AI coding agent) through version 3.54.0 lets attackers slip past the auto-approve execute feature's allowlist/denylist by hiding command substitutions inside shell parameter-expansion defaults. Because the parser replaces parameter expansions with opaque placeholders before scanning for dangerous substitutions, a payload built from an allowlisted prefix carrying a nested $(...) is judged safe, auto-approved on the outer command, and executed by the shell via execa. A public PoC and technical write-up exist (reported by VulnCheck); there is no confirmed active exploitation (not in CISA KEV) and no EPSS score was provided.
Path traversal in RooCodeInc Roo-Code through version 3.51.1 allows remote unauthenticated attackers to read and write files outside the intended working directory by manipulating input processed by the path.resolve function in ApplyPatchTool.ts. The vendor has confirmed they archived the repository and discontinued all support, meaning no patch will ever be released. Publicly available exploit code exists via a GitHub Gist, and no vendor-released patch identified at time of analysis - organizations still running this tool are permanently exposed.
Cleartext transmission of OAuth credentials in RooCodeInc Roo-Code up to version 3.51.1 exposes sensitive OAuth tokens to interception via the OAuth callback handler in src/integrations/claude-code/oauth.ts. The vendor has officially archived the repository and explicitly discourages continued use, meaning no patch will be issued. A public proof-of-concept is available on GitHub, though high attack complexity (requiring a network interception position) constrains opportunistic exploitation.
Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote low-privileged attacker to execute injected code via the `fetch_instructions` function within the MCP (Model Context Protocol) Integration Trust Model component (`malicious_mcp_server.py`). A publicly available proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly confirmed the product is no longer maintained - the repository is archived - meaning no patch will ever be released, permanently leaving all deployed instances vulnerable.
Code injection in RooCodeInc Roo-Code through version 3.51.1 allows remote attackers to execute arbitrary code via the ExecaTerminalProcess function in the README File Handler, triggered by passive user interaction with a crafted README file. The vendor has explicitly archived the repository and confirmed no patch will be issued, leaving all installed instances permanently unpatched. A public proof-of-concept exploit is available on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 2.1 reflects limited impact ratings across all three CIA pillars.
Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote, low-privileged attacker with passive user interaction to inject and execute arbitrary code via the `optimizeQuery` function in the CodeIndexManager component (`src/utils/helpers.ts`). A public proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly archived the repository and will not issue a patch, leaving all users of this product permanently unpatched.