Description
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled.
Metrics
CVSS 3.1 8.8/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| RooCodeInc | Roo-Code | <= 3.54.0 |
References
- https://github.com/7rah/oss-cve/blob/6adb836d24ca446fd168c3acdc4c170beb77fe0f/roocode-glob-token.mdExploit, Mitigation, Third Party Advisory
- https://github.com/RooCodeInc/Roo-Code/blob/v3.54.0/src/shared/parse-command.ts#L148-L172Product
- https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-glob-token-discarding-command-substitutionThird Party Advisory
- https://github.com/7rah/oss-cve/blob/6adb836d24ca446fd168c3acdc4c170beb77fe0f/roocode-glob-token.mdExploit, Mitigation, Third Party Advisory
Timeline
- Published
- Oct 13, 2026
- Last modified
- Oct 26, 2026
- NVD status
- Modified