Executive brief
Roo-Code is a code editing and automation tool that processes patch files to apply code changes. A path traversal vulnerability in the ApplyPatchTool component allows an attacker to craft malicious patch files that, when applied by a victim, modify files outside the intended workspace—potentially compromising SSH keys, shell configuration, or Git credentials for persistent system access.
Technical details
The vulnerability is a path traversal (CWE-22) in src/core/tools/ApplyPatchTool.ts, where the component resolves patch file paths using path.resolve(task.cwd, relPath) without validating that the resulting path remains within the workspace boundary. An attacker can distribute a malicious patch file containing path traversal sequences (e.g., ../../.ssh/authorized_keys) via email, GitHub, Slack, or pull requests. When a victim applies the patch through the Roo-Code agent, the tool processes the path without sanitization and modifies files outside the workspace (e.g., SSH keys, .bashrc, .gitconfig). The attack requires victim interaction (applying the patch) but is highly effective for social engineering. The product is no longer maintained; the vendor has archived the repository and does not support Roo-Code.
Affected products
- RooCodeInc Roo-Code up to 3.51.1
Timeline
- 2026-08-28: disclosed
- 2026-06-20: exploited: Exploit published (POC available via GitHub Gist)