CVE-2026-81836
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Roo-Code up to version 3.51.1 has a vulnerability in the OAuth Callback component (src/integrations/claude-code/oauth.ts) that results in cleartext transmission of sensitive information. The attack can be performed remotely but is difficult to exploit. The project is no longer supported by the maintainer.
Risk Assessment
Interception of sensitive information (e.g., tokens) could lead to unauthorized access to accounts or systems, but due to difficulty of exploitation the risk is limited.
Recommendation
Discontinue use of Roo-Code and migrate to a supported solution, as the project is archived and will not receive fixes.
Other vulnerabilities in Roo-Code
See all- CVE-2026-81837Medium
A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor stated that the project is no longer supported, so this vulnerability only affects products that are no longer supported by the maintainer.
- CVE-2026-81835Medium
A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instructions of the file malicious_mcp_server.py of the component MCP Integration Trust Model. The manipulation leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor stated that the project is no longer supported, so this vulnerability only affects products that are no longer supported by the maintainer.
- CVE-2026-81834Medium
A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a manipulation can lead to code injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor no longer supports this project.
- CVE-2026-81833Medium
A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/helpers.ts of the component CodeIndexManager. Performing a manipulation results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor no longer supports this project.
- CVE-2026-63108High
Roo Code through 3.54.0 has a command injection vulnerability in the auto-approve execute feature. Attackers can bypass allowlist/denylist by nesting command substitutions inside parameter expansion defaults, allowing arbitrary command execution.
Original NVD description (English source)
A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback. The manipulation results in cleartext transmission of sensitive information. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit is now public and may be used. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer.