Executive brief
Roo-Code is a development tool that integrates with external MCP (Model Context Protocol) servers to extend functionality. A vulnerability allows malicious MCP servers to inject arbitrary system instructions into Roo-Code's core logic without validation, potentially enabling attackers to execute commands, steal credentials, or compromise the developer's system. This affects unsupported versions up to 3.51.1, and the vendor has archived the project and no longer supports it.
Technical details
The vulnerability is a code injection flaw (CWE-94, CWE-20) in Roo-Code's MCP integration component, specifically in the fetch_instructions function. External MCP servers can return arbitrary instructions that are incorporated directly into the agent's system prompt without content validation or sanitization. An attacker can distribute a malicious MCP server through npm or GitHub that, when installed by a user, injects commands into the system prompt during normal Roo-Code operation. Since MCP responses are treated as trusted system directives with the highest priority, an attacker can override security policies, execute arbitrary shell commands, and exfiltrate sensitive data such as environment variables or credentials. The attack requires user interaction (installation of the malicious MCP server) and network connectivity to the attacker's infrastructure. The vendor has archived this project and no longer provides support or patches.
Affected products
- RooCodeInc Roo-Code up to 3.51.1
Timeline
- 2026-08-28: disclosed: CVE-2026-81835 published; exploit publicly available
- 2026-06-20: other: Security advisory disclosed on GitHub
- 2026: other: Product archived by vendor; no longer supported