Executive brief
Roo Code, an AI-powered coding assistant, contains a flaw in how it handles automatic command execution. An attacker can use "indirect prompt injection"—for example, by tricking the AI into reading a malicious file or webpage—to bypass security filters and run unauthorized commands on a developer's computer. This could lead to full system compromise, data theft, or the installation of malware without the user's approval.
Technical details
A command injection vulnerability exists in Roo Code's auto-approve mechanism due to improper parsing in 'parse-command.ts'. The parser replaces shell parameter expansions (e.g., ${...}) with opaque placeholders before checking for subshells or command substitutions. Consequently, a malicious payload nested within a parameter expansion default—such as '${x:-$(malicious_command)}'—is ignored by the 'containsDangerousSubstitution' guard. If the outer command (e.g., 'echo') is on the allowlist, the entire string is auto-approved and executed via 'execa', allowing arbitrary shell command execution. This is typically triggered via indirect prompt injection where the agent processes untrusted external data.
Affected products
- RooCodeInc Roo Code (formerly Roo Cline) through 3.54.0
Timeline
- 2026-05-16: other: GitHub repository archived by owner
- 2026-06-12: disclosed: Vulnerability reported to vendor via email
- 2026-07-20: advisory: NVD and VulnCheck advisory published