RooCodeInc vulnerabilities
We track 18 vulnerabilities in RooCodeInc products. 18 are rated high or critical, and none are known to be exploited. The most recent was published on October 13, 2026.
Latest RooCodeInc vulnerabilities
- 8.8 High severity
Roo-Code: Interpretation Conflict
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can s
- 8.8 High severity
Roo-Code: Incomplete List of Disallowed Inputs
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match
- 8.8 High severity
Roo-Code: Interpretation Conflict
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can emb
- 8.8 High severity
Roo-Code: Interpretation Conflict
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine(). Attackers can use indirect prompt injection with escaped or single-quoted
- 8.8 High severity
Roo-Code: Interpretation Conflict
Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allow
- 8.8 High severity
Roo-Code: Interpretation Conflict
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a com
- 8.8 High severity
Roo-Code: Incomplete List of Disallowed Inputs
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. A
- 8.8 High severity
Roo-Code: Incomplete List of Disallowed Inputs
Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in pa
- 8.1 High severity
Roo-Code: Improper Neutralization of Special Elements used in a Command
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list prefixes. This issue has been pat
- 7.8 High severity
Roo-Code: Improper Neutralization of Special Elements used in an OS Command
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because
- 9.8 Critical severity
Roo-Code: Improper Control of Generation of Code
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where certain VS Code workspace configuration files (.code-workspace) are not protected in the same way as the .vscode folder. If
- 9.8 Critical severity
Roo-Code: Improper Neutralization of Special Elements used in an OS Command
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request metadata in a privileged context, allowing an attacker to craft malicious input and achieve Remote Cod
- 8.1 High severity
Roo-Code: Improper Neutralization of Special Elements used in an OS Command
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent was co
- 8.1 High severity
Roo-Code: Improper Neutralization of Special Elements used in an OS Command
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions prior to 3.25.5, Roo-Code fails to properly handle process substitution and single ampersand characters in the command parsing logic for auto-execute commands. If a use
- 7.8 High severity
Roo-Code: Improper Neutralization of Special Elements used in a Command
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode does not validate line breaks (\n) in its command input, allowing potential bypass of the allow-list mechanism. The project appears to lack p
- 8.1 High severity
Roo-Code: Files or Directories Accessible to External Parties
Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker with the ability to submit prompts to the agent could write to VS Code settings files and trigger code execution. There were multiple ways
- 8.1 High severity
Roo-Code: Improper Neutralization of Special Elements used in a Command
Roo Code is an AI-powered autonomous coding agent. The project-specific MCP configuration for the Roo Code agent is stored in the `.roo/mcp.json` file within the VS Code workspace. Because the MCP configuration format allows for execution of arbitrary commands
- 7.5 High severity
Roo-Code: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Roo Code is an AI-powered autonomous coding agent. Prior to version 3.20.3, there was an issue where the Roo Code agent's `search_files` tool did not respect the setting to disable reads outside of the VS Code workspace. This means that an attacker who was abl