Executive brief
Roo-Code is an AI-powered code analysis tool that automatically processes project README files to understand codebase context. The tool fails to sanitize HTML comments in README files, allowing attackers to inject malicious system instructions that are silently executed with full agent privileges. An attacker can plant a malicious README in an npm package or pull request; when a developer opens the project in Roo-Code, the tool automatically processes the file and executes embedded commands to steal credentials (AWS keys, GitHub tokens, SSH keys) or run arbitrary code without any warning or user confirmation.
Technical details
The vulnerability is a code injection flaw (CWE-94, CWE-77) in the README File Handler component, specifically in the ExecaTerminalProcess function. The root cause is that Roo-Code's ReadFileTool automatically reads and parses README.md files, treating HTML comments as trusted system instructions without validation or sanitization. These malicious instructions are directly incorporated into the agent's system context, and when the agent executes commands via ExecaTerminalProcess with shell:true enabled, arbitrary command chaining becomes possible. The attack requires only that a victim opens a project containing a malicious README file (no authentication required; network reachability is implicit in downloading or accessing the project). An attacker can achieve remote code execution, credential exfiltration, and supply chain compromise. The vendor has stated that Roo-Code is no longer supported and the repository is archived; no patches are available.
Affected products
- RooCodeInc Roo-Code up to 3.51.1
Timeline
- 2026-08-27: disclosed: Published on NVD
- 2026-06-20: other: PoC advisory published on GitHub