Executive brief
Roo-Code is an AI code agent that can auto-approve and execute shell commands when enabled. A parsing vulnerability allows attackers to craft commands that bypass the approval denylist by exploiting how comment characters are interpreted. An attacker can execute arbitrary shell commands with the agent's privileges on a developer's machine by crafting a command string with an allowlisted word followed by a hash character and a denied command.
Technical details
The vulnerability is an interpretation conflict (CWE-436) in the approval gate's command parser. The shell-quote library treats # as a comment start even when directly attached to a word (e.g., "hi#"), while bash only treats # as a comment when it begins a word (after whitespace or metacharacters). A command like "echo hi#;touch /tmp/pwned" is parsed as "echo hi" (with the rest dropped as a comment) by the approval gate, matching the allowlist, but bash executes both "echo hi#" and the separator-delimited "touch /tmp/pwned". The attack requires no authentication but does require user interaction (enabling auto-approve). An attacker can achieve arbitrary command execution with the auto-execute agent's privileges on the developer's machine.
Affected products
- Roo Code Roo-Code through 3.54.0
Timeline
- 2026-09-08: disclosed
- 2026-05-16: other: Repository archived by owner