# CVE-2026-63108: Roo Code command injection in auto-approve execute feature

Source: https://junglewise.ai/threats/cve-2026-63108-roo-code-command-injection-in-auto-approve-execute-feature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-63108 · Severity: high · CVSS 8.8 · Published 2026-07-20

Roo Code, an AI-powered coding assistant, contains a flaw in how it handles automatic command execution. An attacker can use "indirect prompt injection"—for example, by tricking the AI into reading a malicious file or webpage—to bypass security filters and run unauthorized commands on a developer's computer. This could lead to full system compromise, data theft, or the installation of malware without the user's approval.

Technologies: [RooCodeInc Roo Code](https://junglewise.ai/threats/technologies/roo-code). Vendors: [RooCodeInc](https://junglewise.ai/threats/vendors/roocodeinc).

## Quick answers

**Is CVE-2026-63108 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63108 being exploited in the wild.

**How severe is CVE-2026-63108?** High severity, with a CVSS score of 8.8, published 20 July 2026.

**Which products and versions are affected?** RooCodeInc Roo Code through 3.54.0.

**Is there a fix for CVE-2026-63108?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-63108 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-63108?** Check whether you run RooCodeInc Roo Code at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in Roo Code's auto-approve mechanism due to improper parsing in 'parse-command.ts'. The parser replaces shell parameter expansions (e.g., ${...}) with opaque placeholders before checking for subshells or command substitutions. Consequently, a malicious payload nested within a parameter expansion default—such as '${x:-$(malicious_command)}'—is ignored by the 'containsDangerousSubstitution' guard. If the outer command (e.g., 'echo') is on the allowlist, the entire string is auto-approved and executed via 'execa', allowing arbitrary shell command execution. This is typically triggered via indirect prompt injection where the agent processes untrusted external data.

## Affected products

- RooCodeInc Roo Code (formerly Roo Cline) through 3.54.0

## Timeline

- 2026-05-16: other: GitHub repository archived by owner
- 2026-06-12: disclosed: Vulnerability reported to vendor via email
- 2026-07-20: advisory: NVD and VulnCheck advisory published

## References

- [https://github.com/geo-chen/oss/blob/main/Roo-Code.md](https://github.com/geo-chen/oss/blob/main/Roo-Code.md)
- [https://www.vulncheck.com/advisories/roo-code-command-injection-via-parameter-expansion-parsing](https://www.vulncheck.com/advisories/roo-code-command-injection-via-parameter-expansion-parsing)

## Related threats

- [RooCodeInc Roo-Code path traversal in ApplyPatchTool](https://junglewise.ai/threats/cve-2026-81837-roocodeinc-roo-code-path-traversal-in-applypatchtool)
- [RooCodeInc Roo-Code cleartext transmission of OAuth credentials](https://junglewise.ai/threats/cve-2026-81836-roocodeinc-roo-code-cleartext-transmission-of-oauth-credentials)
- [RooCodeInc Roo-Code code injection in MCP Integration](https://junglewise.ai/threats/cve-2026-81835-roocodeinc-roo-code-code-injection-in-mcp-integration)
- [RooCodeInc Roo-Code code injection in README File Handler](https://junglewise.ai/threats/cve-2026-81834-roocodeinc-roo-code-code-injection-in-readme-file-handler)
- [RooCodeInc Roo-Code code injection in RAG system](https://junglewise.ai/threats/cve-2026-81833-roocodeinc-roo-code-code-injection-in-rag-system)