What’s Vulnerable › Products

RooCodeInc Roo-Code vulnerabilities

25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 25 published in the last 12 months.

Check whether your RooCodeInc Roo-Code version is affected

Latest RooCodeInc Roo-Code vulnerabilities

• CVE-2026-110206 — Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position (CVSS 8.8)
• CVE-2026-110205 — Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution (CVSS 8.8)
• CVE-2026-110204 — Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution (CVSS 8.8)
• CVE-2026-110203 — Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization (CVSS 8.8)
• CVE-2026-110202 — Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping (CVSS 8.8)
• CVE-2026-82537 — Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch (CVSS 8.8)
• CVE-2026-82536 — Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator (CVSS 8.8)
• CVE-2026-81837 — RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal (CVSS 6.3)
• CVE-2026-81836 — RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission (CVSS 3.7)
• CVE-2026-81835 — RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection (CVSS 5.5)
• CVE-2026-81834 — RooCodeInc Roo-Code README File ExecaTerminalProcess code injection (CVSS 6.3)
• CVE-2026-81833 — RooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection (CVSS 5.5)
• CVE-2026-63108 — Roo Code 3.54.0 Command Injection via Parameter Expansion Parsing (CVSS 8.8)
• CVE-2026-30307 — (CVSS 9.8)
• CVE-2025-65946 — Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug (CVSS 8.1)
• CVE-2025-58374 — Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts (CVSS 7.8)
• CVE-2025-58373 — Roo Code: Symlink-bypass of .rooignore can lead to unintended file disclosure (CVSS 6.5)
• CVE-2025-58372 — Roo Code: Potential Remote Code Execution via .code-workspace (CVSS 9.8)
• CVE-2025-58371 — Roo Code is vulnerable to command injection via GitHub actions workflow (CVSS 9.8)
• CVE-2025-58370 — Roo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect Reference (CVSS 8.1)
• CVE-2025-57771 — Roo-Code potential remote code execution via auto-execute command parsing flaw (CVSS 8.1)
• CVE-2025-54377 — Roo Code Lacks Line Break Validation in its Command Execution Tool (CVSS 7.8)
• CVE-2025-53536 — Roo Code allows Potential Remote Code Execution via .vscode/settings.json (CVSS 8.1)
• CVE-2025-53098 — Roo Code Vulnerable to Potential Remote Code Execution via Model Context Protocol (CVSS 8.1)
• CVE-2025-53097 — Roo Code extension vulnerable to Potential Information Leakage via JSON Schema (CVSS 7.5)