CVE-2026-63108
HighCVSS 8.8Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
Roo Code through 3.54.0 has a command injection vulnerability in the auto-approve execute feature. Attackers can bypass allowlist/denylist by nesting command substitutions inside parameter expansion defaults, allowing arbitrary command execution.
Risk Assessment
An attacker can remotely execute arbitrary commands in the context of the Roo Code extension, potentially leading to system compromise.
Recommendation
Update Roo Code to version 3.54.1 or later, which includes a fix.
Other vulnerabilities in Roo Code
See all- CVE-2026-81837Medium
A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor stated that the project is no longer supported, so this vulnerability only affects products that are no longer supported by the maintainer.
- CVE-2026-81836Low
Roo-Code up to version 3.51.1 has a vulnerability in the OAuth Callback component (src/integrations/claude-code/oauth.ts) that results in cleartext transmission of sensitive information. The attack can be performed remotely but is difficult to exploit. The project is no longer supported by the maintainer.
- CVE-2026-81835Medium
A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instructions of the file malicious_mcp_server.py of the component MCP Integration Trust Model. The manipulation leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor stated that the project is no longer supported, so this vulnerability only affects products that are no longer supported by the maintainer.
- CVE-2026-81834Medium
A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a manipulation can lead to code injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor no longer supports this project.
- CVE-2026-81833Medium
A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/helpers.ts of the component CodeIndexManager. Performing a manipulation results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor no longer supports this project.
Original NVD description (English source)
Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter expansions with opaque placeholders before extracting command substitutions, causing the containsDangerousSubstitution guard to miss nested payloads, which are then auto-approved based on the outer allowlisted command prefix and executed by the shell via execa, enabling arbitrary command execution.