Roo Code (Roocode) - vulnerabilities (CVEs)
19 CVEs, 5 in the last 30 days, 538 known versions, newest CVE from 2026-10-13. Vendor: Roocode.
CVEs of Roo Code
- CVE-2026-110206 - CVSS 8.8 (high), 2026-10-13: Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands…
- CVE-2026-110205 - CVSS 8.8 (high), 2026-10-13: Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob…
- CVE-2026-110204 - CVSS 8.8 (high), 2026-10-13: Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats…
- CVE-2026-110203 - CVSS 8.8 (high), 2026-10-13: Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking…
- CVE-2026-110202 - CVSS 8.8 (high), 2026-10-13: Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands…
- CVE-2026-82537 - CVSS 8.8 (high), 2026-09-08: Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary…
- CVE-2026-82536 - CVSS 8.8 (high), 2026-09-08: Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell…
- CVE-2026-63108 - CVSS 8.8 (high), 2026-07-20: Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist…
- CVE-2026-30307 - CVSS 9.8 (critical), 2026-03-30: Roo Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely…
- CVE-2025-65946 - CVSS 8.1 (high), 2025-11-21: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo…
- CVE-2025-58374 - CVSS 7.8 (high), 2025-09-06: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do…
- CVE-2025-58370 - CVSS 8.1 (high), 2025-09-05: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic…
- CVE-2025-58373 - CVSS 6.5 (medium), 2025-09-05: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where .rooignore…
- CVE-2025-58372 - CVSS 9.8 (critical), 2025-09-05: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where certain VS Code…
- CVE-2025-58371 - CVSS 9.9 (critical), 2025-09-05: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request…
- CVE-2025-54377 - CVSS 7.8 (high), 2025-07-23: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode does not validate line breaks (\n) in…
- CVE-2025-53536 - CVSS 8.1 (high), 2025-07-07: Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker with the ability to submit prompts to…
- CVE-2025-53098 - CVSS 8.1 (high), 2025-06-27: Roo Code is an AI-powered autonomous coding agent. The project-specific MCP configuration for the Roo Code agent is stored in the `.roo/mcp.json` file within…
- CVE-2025-53097 - CVSS 7.5 (high), 2025-06-27: Roo Code is an AI-powered autonomous coding agent. Prior to version 3.20.3, there was an issue where the Roo Code agent's `search_files` tool did not respect…
