CVE-2025-65946

Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug

8.1 High

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list prefixes. This issue has been patched in version 3.26.7.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.71%Up 0.6 points since Nov 22, 2025

What each source reports

CVE List Score used 8.1

Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug

Record: CVE-2025-65946
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77, CWE-20
Updated: 2026-11-02

EUVDEUVD-2025-198528 8.1

Record: EUVD-2025-198528
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

NVD 8.1

Record: CVE-2025-65946
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-20, CWE-77
Updated: 2026-11-02

OSV 8.1

Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug

Record: CVE-2025-65946
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-20, CWE-77
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-65946 is a high vulnerability (CVSS 8.1) in Roocode Roo Code, published November 21, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. No source names a fixed version.