Roocodeinc Roo-code vulnerabilities

• roocode roo code, roocodeinc roo-code +1 more Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position CVE-2026-110206 7.7 HighOctober 13, 2026
• roocode roo code, roocodeinc roo-code +1 more Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution CVE-2026-110205 7.7 HighOctober 13, 2026
• roocode roo code, roocodeinc roo-code +1 more Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution CVE-2026-110204 7.7 HighOctober 13, 2026
• roocode roo code, roocodeinc roo-code +1 more Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization CVE-2026-110203 7.7 HighOctober 13, 2026
• roocode roo code, roocodeinc roo-code +1 more Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping CVE-2026-110202 7.7 HighOctober 13, 2026
• roocodeinc roo-code Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch CVE-2026-82537 7.7 HighSeptember 8, 2026
• roocodeinc roo-code Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator CVE-2026-82536 7.7 HighSeptember 8, 2026
• roocodeinc roo-code RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal CVE-2026-81837 5.3 MediumAugust 27, 2026
• roocodeinc roo-code RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission CVE-2026-81836 6.3 MediumAugust 27, 2026
• roocodeinc roo-code RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection CVE-2026-81835 5.1 MediumAugust 27, 2026
• roocodeinc roo-code RooCodeInc Roo-Code README File ExecaTerminalProcess code injection CVE-2026-81834 5.3 MediumAugust 27, 2026
• roocodeinc roo-code RooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection CVE-2026-81833 5.1 MediumAugust 27, 2026
• roocodeinc roo-code Roo Code 3.54.0 Command Injection via Parameter Expansion Parsing CVE-2026-63108 7.7 HighJuly 20, 2026
• roocode roo code, roocodeinc roo-code +1 more Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug CVE-2025-65946 8.1 HighNovember 21, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts CVE-2025-58374 7.8 HighSeptember 6, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code: Symlink-bypass of .rooignore can lead to unintended file disclosure CVE-2025-58373 5.5 MediumSeptember 5, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code: Potential Remote Code Execution via .code-workspace CVE-2025-58372 8.1 HighSeptember 5, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code is vulnerable to command injection via GitHub actions workflow CVE-2025-58371 Public exploit 9.9 CriticalSeptember 5, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect Reference CVE-2025-58370 8.1 HighSeptember 5, 2025
• roocodeinc roo-code Roo-Code potential remote code execution via auto-execute command parsing flaw CVE-2025-57771 8.1 HighAugust 22, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code Lacks Line Break Validation in its Command Execution Tool CVE-2025-54377 7.8 HighJuly 23, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code allows Potential Remote Code Execution via .vscode/settings.json CVE-2025-53536 8.1 HighJuly 7, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code Vulnerable to Potential Remote Code Execution via Model Context Protocol CVE-2025-53098 8.1 HighJune 27, 2025
• roocode roo code, roocodeinc roo-code +1 more Roo Code extension vulnerable to Potential Information Leakage via JSON Schema CVE-2025-53097 5.9 MediumJune 27, 2025