# CVE-2026-110204: Roo Code command approval bypass via bash funsub injection

Source: https://junglewise.ai/threats/cve-2026-110204-roo-code-through-3-54-0-contains-a-command-approval-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110204 · Severity: high · CVSS 8.8 · Published 2026-10-13

Roo Code, an AI coding assistant that auto-approves shell commands against a security allowlist, can be bypassed to execute denied commands without user approval. An attacker can use indirect prompt injection to embed a blocked command like "touch" inside bash 5.3+ command substitution syntax, disguising it as a parameter expansion so the approval gate approves it, then bash executes the hidden command. This allows an attacker to perform arbitrary file operations or execute other privileged commands on a developer's machine.

Technologies: [Roo Code Inc Roo Code](https://junglewise.ai/threats/technologies/roo-code-inc-roo-code), [Roocode Roo Code](https://junglewise.ai/threats/technologies/roocode-roo-code). Vendors: [Roo Code Inc](https://junglewise.ai/threats/vendors/roo-code-inc), [Roocode](https://junglewise.ai/threats/vendors/roocode).

## Quick answers

**Is CVE-2026-110204 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110204 being exploited in the wild.

**How severe is CVE-2026-110204?** High severity, with a CVSS score of 8.8, published 13 October 2026.

**Which products and versions are affected?** Roo Code Inc Roo Code through 3.54.0.

**Is there a fix for CVE-2026-110204?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-110204 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110204?** Check whether you run Roo Code Inc Roo Code or Roocode Roo Code at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is in parseCommand() in parse-command.ts, which masks shell constructs before checking commands against allowlists. The regex /\$\{[^}]+\}/ intended to mask parameter expansions like ${var:-default} also matches the bash 5.3+ command substitution syntax ${ command; } (funcsub), treating it as an opaque parameter expansion and never examining the command inside. When a denied command is embedded as echo ${ touch /tmp/file; }, the parser approves it because it matches the "echo" allowlist prefix. On bash 5.3+, ksh93, or other shells supporting funsubs, the braces execute the hidden command. The attack requires the auto-approval feature enabled and targets the parseCommand/getCommandDecision logic.

## Affected products

- Roo Code Inc Roo Code through 3.54.0

## Timeline

- 2026-10-13: disclosed

## References

- [https://github.com/7rah/oss-cve/blob/6adb836d24ca446fd168c3acdc4c170beb77fe0f/roocode-group03-funsub.md](https://github.com/7rah/oss-cve/blob/6adb836d24ca446fd168c3acdc4c170beb77fe0f/roocode-group03-funsub.md)
- [https://github.com/RooCodeInc/Roo-Code/blob/v3.54.0/src/shared/parse-command.ts](https://github.com/RooCodeInc/Roo-Code/blob/v3.54.0/src/shared/parse-command.ts)

## Related threats

- [Roo Code command approval bypass via command substitution](https://junglewise.ai/threats/cve-2026-110206-roo-code-through-3-54-0-contains-a-command-approval-bypass)
- [Roo Code command approval bypass via glob character masking](https://junglewise.ai/threats/cve-2026-110205-roo-code-through-3-54-0-contains-a-command-approval-bypass)
- [Roo Code command approval bypass via quote masking](https://junglewise.ai/threats/cve-2026-110203-roo-code-through-3-54-0-contains-a-command-approval-bypass)
- [Roo Code command approval bypass via shell redirect](https://junglewise.ai/threats/cve-2026-110202-roo-code-through-3-54-0-contains-a-command-approval-bypass)
- [Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an…](https://junglewise.ai/threats/cve-2025-65946-roo-code-is-an-ai-powered-autonomous-coding-agent-that-lives-in)