Roocode vulnerabilities

Products

• Roo Code 16

Newest

• roocode roo code, roocodeinc roo-code +1 more Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position CVE-2026-110206 7.7 HighOctober 13, 2026
• roocode roo code, roocodeinc roo-code +1 more Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution CVE-2026-110205 7.7 HighOctober 13, 2026
• roocode roo code, roocodeinc roo-code +1 more Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution CVE-2026-110204 7.7 HighOctober 13, 2026
• roocode roo code, roocodeinc roo-code +1 more Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization CVE-2026-110203 7.7 HighOctober 13, 2026
• roocode roo code, roocodeinc roo-code +1 more Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping CVE-2026-110202 7.7 HighOctober 13, 2026
• roocode roo code Roo Code's command auto-approval module contains a critical OS command injection vulnerability... CVE-2026-30307 9.8 CriticalMarch 30, 2026
• roocode roo code, roocodeinc roo-code +1 more Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug CVE-2025-65946 8.1 HighNovember 21, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts CVE-2025-58374 7.8 HighSeptember 6, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code: Symlink-bypass of .rooignore can lead to unintended file disclosure CVE-2025-58373 5.5 MediumSeptember 5, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code: Potential Remote Code Execution via .code-workspace CVE-2025-58372 8.1 HighSeptember 5, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code is vulnerable to command injection via GitHub actions workflow CVE-2025-58371 Public exploit 9.9 CriticalSeptember 5, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect Reference CVE-2025-58370 8.1 HighSeptember 5, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code Lacks Line Break Validation in its Command Execution Tool CVE-2025-54377 7.8 HighJuly 23, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code allows Potential Remote Code Execution via .vscode/settings.json CVE-2025-53536 8.1 HighJuly 7, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code Vulnerable to Potential Remote Code Execution via Model Context Protocol CVE-2025-53098 8.1 HighJune 27, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code extension vulnerable to Potential Information Leakage via JSON Schema CVE-2025-53097 5.9 MediumJune 27, 2025