Is CVE-2026-82537 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82537 being exploited in the wild.

How severe is CVE-2026-82537?

High severity, with a CVSS score of 8.8, published 8 September 2026.

Which products and versions are affected?

Roo Code Roo-Code through 3.54.0.

Is there a fix for CVE-2026-82537?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82537 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82537?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82537: Roo-Code auto-approve bypass via shell parser word-boundary mismatch

CVE-2026-82537 · Severity: high · CVSS 8.8 · Published 2026-09-08

Roo-Code is an AI code agent that can auto-approve and execute shell commands when enabled. A parsing vulnerability allows attackers to craft commands that bypass the approval denylist by exploiting how comment characters are interpreted. An attacker can execute arbitrary shell commands with the agent's privileges on a developer's machine by crafting a command string with an allowlisted word followed by a hash character and a denied command.

Quick answers

Is CVE-2026-82537 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82537 being exploited in the wild.
How severe is CVE-2026-82537?: High severity, with a CVSS score of 8.8, published 8 September 2026.
Which products and versions are affected?: Roo Code Roo-Code through 3.54.0.
Is there a fix for CVE-2026-82537?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82537 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82537?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an interpretation conflict (CWE-436) in the approval gate's command parser. The shell-quote library treats # as a comment start even when directly attached to a word (e.g., "hi#"), while bash only treats # as a comment when it begins a word (after whitespace or metacharacters). A command like "echo hi#;touch /tmp/pwned" is parsed as "echo hi" (with the rest dropped as a comment) by the approval gate, matching the allowlist, but bash executes both "echo hi#" and the separator-delimited "touch /tmp/pwned". The attack requires no authentication but does require user interaction (enabling auto-approve). An attacker can achieve arbitrary command execution with the auto-execute agent's privileges on the developer's machine.

Affected products

Roo Code Roo-Code through 3.54.0

Timeline

2026-09-08: disclosed
2026-05-16: other: Repository archived by owner

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.