{
 "schema_version": "0.4",
 "id": "REG-0029",
 "title": "Roo Code: crafted shell commands pass the coding agent's command allowlist and run without user approval; five CVEs published 13 October 2026, project archived with no fix",
 "batch": "agent-2026-10-14",
 "family": "software",
 "context": {
  "domain": "Software agent (coding agent running shell commands on a developer machine)",
  "autonomy_level": "alone",
  "autonomy_level_text": "Commands that match the allowlist are auto-approved and run with no user decision",
  "actor_type": "Software: Roo Code through 3.54.0",
  "actors": {
   "count": 1,
   "text": "1 coding agent; attacker supplies content through indirect prompt injection",
   "roles": [
    "defender"
   ]
  },
  "mandate_context": "demonstration",
  "mandate_context_text": "Vulnerability disclosure; no exploitation reported",
  "jurisdiction": [
   "Global (open-source developer tool)"
  ]
 },
 "actor_status": "confirmed",
 "provenance_tier": "disclosure_corroborated",
 "provenance_tier_text": "Five CVE records in the National Vulnerability Database, corroborated by the vendor's own repository showing it archived at the affected version",
 "status": "confirmed",
 "status_text": "Confirmed (no fix; no exploitation reported)",
 "outcome": {
  "state": "pending",
  "severity": "none reported (each record carries VulnCheck's CVSS, Common Vulnerability Scoring System, severity scores: 7.7 High under version 4.0 and 8.8 High under version 3.1)",
  "affected_parties": [],
  "cost": "none reported",
  "regime_consequence": "none",
  "as_of": "21 Oct 2026",
  "derived_by": "agent"
 },
 "fields": [
  {
   "layer": "Mandate",
   "facet": "principal",
   "value": "A developer running Roo Code with auto-approval of allowlisted shell commands enabled",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-110205"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Mandate",
   "facet": "objective",
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-110202",
    "NVD-110203",
    "NVD-110204",
    "NVD-110205",
    "NVD-110206"
   ],
   "confidence": "low",
   "disputed": false
  },
  {
   "layer": "Actor",
   "facet": null,
   "value": "Roo Code through 3.54.0, which runs shell commands on the developer machine and decides through getCommandDecision() and parseCommandLine() whether a command is auto-approved",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-110202",
    "NVD-110203",
    "NVD-110204",
    "NVD-110205",
    "NVD-110206"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Inputs",
   "facet": null,
   "value": "Described, not demonstrated: the records say attackers using indirect prompt injection can lead the agent to propose a crafted shell command; the reporters' write-ups call this 'the realistic trigger', and their proofs of concept call the approval code directly rather than going through the agent",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-110202",
    "NVD-110203",
    "NVD-110204",
    "NVD-110205",
    "NVD-110206",
    "RESEARCHER"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Decision",
   "facet": null,
   "value": "The approval check matched the crafted command to an allowlisted prefix such as echo and auto-approved it, while the shell would run a denied command: a bare >& redirect prefix (110202); escaped or single-quoted double quotes defeating the quote-masking regex (110203); ${ command; } substitutions treated as parameter expansions on bash 5.3+ or ksh93 (110204); command substitutions next to * or ? discarded (110205); a command substitution in command position (110206)",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-110202",
    "NVD-110203",
    "NVD-110204",
    "NVD-110205",
    "NVD-110206"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Envelope",
   "facet": "constraints",
   "value": "A command allowlist and denylist enforced by the agent's own parser, which interprets command lines differently from the shell that runs them",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-110202",
    "NVD-110203",
    "NVD-110204",
    "NVD-110205",
    "NVD-110206"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Action",
   "facet": null,
   "value": "The shell runs the denied command on the developer machine without user approval",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-110202",
    "NVD-110203",
    "NVD-110204",
    "NVD-110205",
    "NVD-110206"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Outcome",
   "facet": null,
   "value": "State: pending (no fix has shipped). No exploitation reported in the sources. The records carry a coordinator assessment by CISA (the US Cybersecurity and Infrastructure Security Agency) rating exploitation 'poc' (proof of concept public) for CVE-2026-110202 and CVE-2026-110204 and 'none' for CVE-2026-110203 and CVE-2026-110206; CVE-2026-110205 has no such assessment. As of 21 Oct 2026.",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-110202",
    "NVD-110203",
    "NVD-110204",
    "NVD-110205",
    "NVD-110206"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Evidence",
   "facet": "event",
   "value": "Five CVE (Common Vulnerabilities and Exposures) records published on 13 October 2026 by VulnCheck, the numbering authority, and shown in the National Vulnerability Database (NVD), affected versions through 3.54.0; VulnCheck scored each 7.7 under CVSS (Common Vulnerability Scoring System) version 4.0 and 8.8 under CVSS version 3.1. The write-ups each record cites contain proof-of-concept runs of the two unmodified approval source files and of bash, not of the running agent. An earlier record, CVE-2026-82536 (8 September 2026), describes the same kind of bypass through the |& operator (a pipe carrying both standard output and standard error) in the same versions",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-110202",
    "NVD-110203",
    "NVD-110204",
    "NVD-110205",
    "NVD-110206",
    "VC-82536",
    "RESEARCHER"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "technical",
   "value": "No fixed version is named in the records, and each record carries the tag 'unsupported-when-assigned' (the product was no longer supported by its maintainer when the identifier was assigned). The vendor's repository was archived by its owner on 15 May 2026 and is read-only; v3.54.0, released 15 May, is its latest release. The extension's Visual Studio Code Marketplace listing, still at version 3.54.0, says 'The Roo Code Extension was shut down on May 15th'",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-110202",
    "NVD-110203",
    "NVD-110204",
    "NVD-110205",
    "NVD-110206",
    "REPO",
    "MARKETPLACE"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "accountability",
   "value": "No vendor statement about these five records was found. In August 2026, answering other Roo Code vulnerability reports filed through VulDB, the vendor said they 'all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it' (as quoted by VulDB in CVE-2026-81834)",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-81834"
   ],
   "confidence": "medium",
   "disputed": false
  }
 ],
 "inference": {
  "value": "The five records describe one approval check, in getCommandDecision() and parseCommandLine(), that reads a command line differently from the shell that runs it, so a command the check takes for an allowlisted one such as echo is auto-approved while the shell runs a different command. The reporters showed this by running the approval code and bash directly, not through the agent. The records do not show an attack through the running agent, any exploitation, whether the vendor was told before publication, or a fix; the product had been shut down and was unsupported when the identifiers were assigned.",
  "source_ids": [
   "NVD-110202",
   "NVD-110203",
   "NVD-110204",
   "NVD-110205",
   "NVD-110206",
   "RESEARCHER",
   "MARKETPLACE"
  ],
  "confidence": "medium",
  "signed_by": "Saurabh Bhatnagar",
  "signed_on": "2026-10-21"
 },
 "controls": {
  "failed": [
   {
    "id": "C-D1",
    "note": "Mechanism: the pre-execution approval check parsed each crafted command as an allowlisted one (for example echo) while the shell executed a denied command. Why it interrupts: a check that resolves the command the way the shell will (or refuses what it cannot parse) would have sent these commands to the user instead of auto-approving them. Source shows it failed: all five records describe the check approving the command.",
    "confidence": "high",
    "basis": "agent"
   },
   {
    "id": "C-I1",
    "note": "Mechanism: the records name indirect prompt injection as the route by which attacker content becomes the command the agent proposes. Why it interrupts: if retrieved content were never treated as instruction, the attacker could not choose the command. Source shows it failed only by naming the route: the reporters' proofs of concept call the approval code directly and do not exercise this route; the counterfactual is not shown.",
    "confidence": "low",
    "basis": "agent"
   }
  ],
  "succeeded": [],
  "absent": []
 },
 "applicable_rules": [
  "None applicable"
 ],
 "unmapped": [],
 "named_parties": [
  {
   "name": "Roo Code",
   "right_of_reply": {
    "offered": "2026-10-22",
    "response": null,
    "acknowledged": "2026-10-23"
   }
  }
 ],
 "sources": {
  "NVD-110202": {
   "title": "NVD record CVE-2026-110202: Roo Code through 3.54.0 command approval bypass (bare >& redirect prefix), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck",
   "type": "public_record",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110202",
   "date": "2026-10-13",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21"
  },
  "NVD-110203": {
   "title": "NVD record CVE-2026-110203: Roo Code through 3.54.0 command approval bypass (quote-masking regex in parseCommandLine()), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck",
   "type": "public_record",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110203",
   "date": "2026-10-13",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21"
  },
  "NVD-110204": {
   "title": "NVD record CVE-2026-110204: Roo Code through 3.54.0 command approval bypass (${ command; } substitution treated as parameter expansion), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck",
   "type": "public_record",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110204",
   "date": "2026-10-13",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21"
  },
  "NVD-110205": {
   "title": "NVD record CVE-2026-110205: Roo Code through 3.54.0 command approval bypass (command substitution next to a glob character discarded), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck",
   "type": "public_record",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110205",
   "date": "2026-10-13",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21"
  },
  "NVD-110206": {
   "title": "NVD record CVE-2026-110206: Roo Code through 3.54.0 command approval bypass (command substitution in command position), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck",
   "type": "public_record",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110206",
   "date": "2026-10-13",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21"
  },
  "VC-82536": {
   "title": "VulnCheck advisory CVE-2026-82536: Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator",
   "type": "researcher",
   "url": "https://www.vulncheck.com/advisories/roo-code-auto-approve-bypass-via-shell-command-pipe-operator",
   "date": "2026-09-08",
   "tier": "researcher",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21"
  },
  "REPO": {
   "title": "RooCodeInc/Roo-Code releases page on GitHub: repository archived by the owner on 15 May 2026; latest release v3.54.0",
   "type": "company",
   "url": "https://github.com/RooCodeInc/Roo-Code/releases",
   "date": "2026-05-15",
   "tier": "company",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21"
  },
  "RESEARCHER": {
   "title": "7rah/oss-cve on GitHub, commit 6adb836: \"add 5 Roo-Code auto-approve bypass advisories\" (the researcher disclosure write-ups, with proofs of concept, cited by each of the five records)",
   "type": "researcher",
   "url": "https://github.com/7rah/oss-cve/commit/6adb836d24ca446fd168c3acdc4c170beb77fe0f",
   "date": "2026-10-13",
   "tier": "researcher",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "MARKETPLACE": {
   "title": "Roo Code - Visual Studio Marketplace",
   "type": "company",
   "url": "https://marketplace.visualstudio.com/items?itemName=RooVeterinaryInc.roo-cline",
   "date": "2026-05-15",
   "tier": "company",
   "interest": "vendor describing its own product",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "NVD-81834": {
   "title": "NVD record CVE-2026-81834: RooCodeInc Roo-Code up to 3.51.1 code injection (VulDB record quoting the vendor that Roo Code is a project it no longer supports)",
   "type": "public_record",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81834",
   "date": "2026-08-27",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  }
 },
 "corrections": [
  {
   "date": "2026-10-21",
   "field": "sources.RESEARCHER",
   "old": null,
   "new": "{\"title\": \"7rah/oss-cve on GitHub, commit 6adb836: \\\"add 5 Roo-Code auto-approve bypass advisories\\\" (the researcher disclosure write-ups, with proofs of concept, cited by each of the five records)\", \"type\": \"researcher\", \"url\": \"https://github.com/7rah/oss-cve/commit/6adb836d24ca446fd168c3acdc4c170beb77fe0f\", \"date\": \"2026-10-13\", \"tier\": \"researcher\", \"interest\": null, \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: each of the five NVD records cites these write-ups as the researcher disclosure (tagged Exploit by NVD); they contain the proofs of concept and show how the flaw was demonstrated"
  },
  {
   "date": "2026-10-21",
   "field": "sources.MARKETPLACE",
   "old": null,
   "new": "{\"title\": \"Roo Code - Visual Studio Marketplace\", \"type\": \"company\", \"url\": \"https://marketplace.visualstudio.com/items?itemName=RooVeterinaryInc.roo-cline\", \"date\": \"2026-05-15\", \"tier\": \"company\", \"interest\": \"vendor describing its own product\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the vendor's Visual Studio Code Marketplace listing, still at version 3.54.0, says 'The Roo Code Extension was shut down on May 15th'; the same sentence is in the v3.54.0 README"
  },
  {
   "date": "2026-10-21",
   "field": "sources.NVD-81834",
   "old": null,
   "new": "{\"title\": \"NVD record CVE-2026-81834: RooCodeInc Roo-Code up to 3.51.1 code injection (VulDB record quoting the vendor that Roo Code is a project it no longer supports)\", \"type\": \"public_record\", \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2026-81834\", \"date\": \"2026-08-27\", \"tier\": \"public_regulatory\", \"interest\": null, \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the VulDB record CVE-2026-81834 (27 August 2026) quotes the vendor's statement on Roo Code's support status, the only vendor statement found"
  },
  {
   "date": "2026-10-21",
   "field": "sources.NVD-110202.title",
   "old": "NVD record CVE-2026-110202: Roo Code through 3.54.0 command approval bypass (bare >& redirect prefix), CVSS 7.7",
   "new": "NVD record CVE-2026-110202: Roo Code through 3.54.0 command approval bypass (bare >& redirect prefix), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck",
   "reason": "Found in the editor's source check of 21 October 2026: the 110202 record (NVD application programming interface copy) carries two VulnCheck scores, CVSS version 4.0 base score 7.7 and CVSS version 3.1 base score 8.8; the title gave only 7.7 with no version"
  },
  {
   "date": "2026-10-21",
   "field": "sources.NVD-110203.title",
   "old": "NVD record CVE-2026-110203: Roo Code through 3.54.0 command approval bypass (quote-masking regex in parseCommandLine()), CVSS 7.7",
   "new": "NVD record CVE-2026-110203: Roo Code through 3.54.0 command approval bypass (quote-masking regex in parseCommandLine()), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck",
   "reason": "Found in the editor's source check of 21 October 2026: the 110203 record (NVD application programming interface copy) carries two VulnCheck scores, CVSS version 4.0 base score 7.7 and CVSS version 3.1 base score 8.8; the title gave only 7.7 with no version"
  },
  {
   "date": "2026-10-21",
   "field": "sources.NVD-110204.title",
   "old": "NVD record CVE-2026-110204: Roo Code through 3.54.0 command approval bypass (${ command; } substitution treated as parameter expansion), CVSS 7.7",
   "new": "NVD record CVE-2026-110204: Roo Code through 3.54.0 command approval bypass (${ command; } substitution treated as parameter expansion), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck",
   "reason": "Found in the editor's source check of 21 October 2026: the 110204 record (NVD application programming interface copy) carries two VulnCheck scores, CVSS version 4.0 base score 7.7 and CVSS version 3.1 base score 8.8; the title gave only 7.7 with no version"
  },
  {
   "date": "2026-10-21",
   "field": "sources.NVD-110205.title",
   "old": "NVD record CVE-2026-110205: Roo Code through 3.54.0 command approval bypass (command substitution next to a glob character discarded), CVSS 7.7",
   "new": "NVD record CVE-2026-110205: Roo Code through 3.54.0 command approval bypass (command substitution next to a glob character discarded), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck",
   "reason": "Found in the editor's source check of 21 October 2026: the 110205 record (NVD application programming interface copy) carries two VulnCheck scores, CVSS version 4.0 base score 7.7 and CVSS version 3.1 base score 8.8; the title gave only 7.7 with no version"
  },
  {
   "date": "2026-10-21",
   "field": "sources.NVD-110206.title",
   "old": "NVD record CVE-2026-110206: Roo Code through 3.54.0 command approval bypass (command substitution in command position), CVSS 7.7",
   "new": "NVD record CVE-2026-110206: Roo Code through 3.54.0 command approval bypass (command substitution in command position), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck",
   "reason": "Found in the editor's source check of 21 October 2026: the 110206 record (NVD application programming interface copy) carries two VulnCheck scores, CVSS version 4.0 base score 7.7 and CVSS version 3.1 base score 8.8; the title gave only 7.7 with no version"
  },
  {
   "date": "2026-10-21",
   "field": "sources.VC-82536.title",
   "old": "VulnCheck advisory CVE-2026-82536: Roo-Code auto-approve bypass via shell command pipe operator, through 3.54.0",
   "new": "VulnCheck advisory CVE-2026-82536: Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator",
   "reason": "Found in the editor's source check of 21 October 2026: the VulnCheck advisory's exact headline is 'Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator'"
  },
  {
   "date": "2026-10-21",
   "field": "outcome.severity",
   "old": "none reported (CVSS 7.7 on each record)",
   "new": "none reported (each record carries VulnCheck's CVSS, Common Vulnerability Scoring System, severity scores: 7.7 High under version 4.0 and 8.8 High under version 3.1)",
   "reason": "Found in the editor's source check of 21 October 2026: the five NVD records show the 7.7 is VulnCheck's CVSS version 4.0 base score and that VulnCheck also gives a CVSS version 3.1 base score of 8.8 on each; NVD added no score of its own"
  },
  {
   "date": "2026-10-21",
   "field": "outcome.as_of",
   "old": "Oct 2026",
   "new": "21 Oct 2026",
   "reason": "Found in the editor's source check of 21 October 2026: the records were updated after drafting (CISA coordinator assessments 13-16 October, NVD analysis 15-16 October); no fix, new record or exploitation report found up to 21 October 2026"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Inputs",
   "old": "Attacker-controlled content that reaches the agent through indirect prompt injection and leads it to propose a crafted shell command",
   "new": "Described, not demonstrated: the records say attackers using indirect prompt injection can lead the agent to propose a crafted shell command; the reporters' write-ups call this 'the realistic trigger', and their proofs of concept call the approval code directly rather than going through the agent",
   "reason": "Found in the editor's source check of 21 October 2026: the five NVD records say attackers 'using indirect prompt injection can' do this; the cited write-ups (RESEARCHER) call it 'the realistic trigger' and their proofs of concept run getCommandDecision() on two unmodified source files, so the route is described, not demonstrated"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Inputs.source_ids",
   "old": "[\"NVD-110202\", \"NVD-110203\", \"NVD-110204\", \"NVD-110205\", \"NVD-110206\"]",
   "new": "[\"NVD-110202\", \"NVD-110203\", \"NVD-110204\", \"NVD-110205\", \"NVD-110206\", \"RESEARCHER\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the reworded value rests on the researcher write-ups as well as the records"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Outcome",
   "old": "State: averted by disclosure. No exploitation reported in the sources. As of Oct 2026.",
   "new": "State: averted by disclosure. No exploitation reported in the sources. The records carry a coordinator assessment by CISA (the US Cybersecurity and Infrastructure Security Agency) rating exploitation 'poc' (proof of concept public) for CVE-2026-110202 and CVE-2026-110204 and 'none' for CVE-2026-110203 and CVE-2026-110206; CVE-2026-110205 has no such assessment. As of 21 Oct 2026.",
   "reason": "Found in the editor's source check of 21 October 2026: the NVD records carry CISA's Stakeholder-Specific Vulnerability Categorization entries added 13-16 October 2026: exploitation 'poc' for 110202 and 110204, 'none' for 110203 and 110206, none recorded for 110205"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Evidence event",
   "old": "Five NVD records published 13 October 2026, each scored CVSS 7.7, affected versions through 3.54.0; an earlier advisory, CVE-2026-82536 (8 September 2026), describes the same kind of bypass through the pipe operator in the same versions",
   "new": "Five CVE (Common Vulnerabilities and Exposures) records published on 13 October 2026 by VulnCheck, the numbering authority, and shown in the National Vulnerability Database (NVD), affected versions through 3.54.0; VulnCheck scored each 7.7 under CVSS (Common Vulnerability Scoring System) version 4.0 and 8.8 under CVSS version 3.1. The write-ups each record cites contain proof-of-concept runs of the two unmodified approval source files and of bash, not of the running agent. An earlier record, CVE-2026-82536 (8 September 2026), describes the same kind of bypass through the |& operator (a pipe carrying both standard output and standard error) in the same versions",
   "reason": "Found in the editor's source check of 21 October 2026: the NVD records show the 7.7 is a VulnCheck CVSS version 4.0 score with a CVSS version 3.1 score of 8.8 alongside; the cited write-ups (RESEARCHER) show proofs of concept run against the source files and bash; the VulnCheck advisory VC-82536 describes the 'stderr-redirecting pipe operator' (|&), and the write-up notes the ordinary pipe is split correctly"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Evidence event.source_ids",
   "old": "[\"NVD-110202\", \"NVD-110203\", \"NVD-110204\", \"NVD-110205\", \"NVD-110206\", \"VC-82536\"]",
   "new": "[\"NVD-110202\", \"NVD-110203\", \"NVD-110204\", \"NVD-110205\", \"NVD-110206\", \"VC-82536\", \"RESEARCHER\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the proof-of-concept statement rests on the researcher write-ups"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery technical",
   "old": "No fixed version is named in the records. The vendor's repository was archived by its owner on 15 May 2026 and is read-only; v3.54.0, released 15 May, is its latest release",
   "new": "No fixed version is named in the records, and each record carries the tag 'unsupported-when-assigned' (the product was no longer supported by its maintainer when the identifier was assigned). The vendor's repository was archived by its owner on 15 May 2026 and is read-only; v3.54.0, released 15 May, is its latest release. The extension's Visual Studio Code Marketplace listing, still at version 3.54.0, says 'The Roo Code Extension was shut down on May 15th'",
   "reason": "Found in the editor's source check of 21 October 2026: each of the five NVD records carries VulnCheck's 'unsupported-when-assigned' tag, and the vendor's Marketplace listing (MARKETPLACE) says the extension was shut down on May 15th"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery technical.source_ids",
   "old": "[\"NVD-110202\", \"NVD-110203\", \"NVD-110204\", \"NVD-110205\", \"NVD-110206\", \"REPO\"]",
   "new": "[\"NVD-110202\", \"NVD-110203\", \"NVD-110204\", \"NVD-110205\", \"NVD-110206\", \"REPO\", \"MARKETPLACE\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the shutdown notice comes from the Marketplace listing"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery accountability",
   "old": "not evidenced in source",
   "new": "No vendor statement about these five records was found. In August 2026, answering other Roo Code vulnerability reports filed through VulDB, the vendor said they 'all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it' (as quoted by VulDB in CVE-2026-81834)",
   "reason": "Found in the editor's source check of 21 October 2026: the VulDB record CVE-2026-81834 (27 August 2026) quotes the vendor's statement that Roo Code is a project it no longer supports; no statement about the five October records was found"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery accountability.confidence",
   "old": "low",
   "new": "medium",
   "reason": "Found in the editor's source check of 21 October 2026: the vendor's words are quoted by VulDB, a numbering authority, in a public record"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery accountability.source_ids",
   "old": "[\"NVD-110202\", \"NVD-110203\", \"NVD-110204\", \"NVD-110205\", \"NVD-110206\"]",
   "new": "[\"NVD-81834\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the statement is in the CVE-2026-81834 record, not the five records"
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "An allowlist is only as strong as the agreement between the parser that checks a command and the shell that runs it; five separate mismatches in one parser show the check was guarding a different command from the one executed.",
   "new": "The five records describe one approval check, in getCommandDecision() and parseCommandLine(), that reads a command line differently from the shell that runs it, so a command the check takes for an allowlisted one such as echo is auto-approved while the shell runs a different command. The reporters showed this by running the approval code and bash directly, not through the agent. The records do not show an attack through the running agent, any exploitation, whether the vendor was told before publication, or a fix; the product had been shut down and was unsupported when the identifiers were assigned.",
   "reason": "Found in the editor's source check of 21 October 2026: 'five separate mismatches in one parser' overstated the records: CVE-2026-110202 is in getCommandDecision()'s redirect stripping, which the write-up calls 'decision-side, independent of the tokenizer'; the interpretation now also says what the records do not show (the write-ups' proofs of concept bypass the agent; no record reports exploitation, a fix or vendor notice). The interpretation was not signed"
  },
  {
   "date": "2026-10-21",
   "field": "inference.source_ids",
   "old": "[\"NVD-110202\", \"NVD-110203\", \"NVD-110204\", \"NVD-110205\", \"NVD-110206\"]",
   "new": "[\"NVD-110202\", \"NVD-110203\", \"NVD-110204\", \"NVD-110205\", \"NVD-110206\", \"RESEARCHER\", \"MARKETPLACE\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the reworded interpretation rests on the researcher write-ups and the Marketplace shutdown notice as well as the records"
  },
  {
   "date": "2026-10-21",
   "field": "controls.C-I1",
   "old": "{\"id\": \"C-I1\", \"note\": \"Mechanism: the records name indirect prompt injection as the route by which attacker content becomes the command the agent proposes. Why it interrupts: if retrieved content were never treated as instruction, the attacker could not choose the command. Source shows it failed only by naming the route; the counterfactual is not shown.\", \"confidence\": \"medium\", \"basis\": \"agent\"}",
   "new": "{\"id\": \"C-I1\", \"note\": \"Mechanism: the records name indirect prompt injection as the route by which attacker content becomes the command the agent proposes. Why it interrupts: if retrieved content were never treated as instruction, the attacker could not choose the command. Source shows it failed only by naming the route: the reporters' proofs of concept call the approval code directly and do not exercise this route; the counterfactual is not shown.\", \"confidence\": \"low\", \"basis\": \"agent\"}",
   "reason": "Found in the editor's source check of 21 October 2026: the researcher write-ups (RESEARCHER) call indirect prompt injection 'the realistic trigger' but their proofs of concept run the approval function directly, so the failure of this control is described, not demonstrated; confidence lowered to low"
  },
  {
   "date": "2026-10-21",
   "field": "outcome.state",
   "old": "averted_by_disclosure",
   "new": "pending",
   "reason": "Editor's call H1 of 21 October 2026 (accepted as amended, pull request #79): no fix has shipped in a published release, so the outcome is not yet known; 'averted by disclosure' claimed an outcome that has not happened."
  },
  {
   "date": "2026-10-22",
   "field": "fields.Outcome",
   "old": "State: averted by disclosure. No exploitation reported in the sources. The records carry a coordinator assessment by CISA (the US Cybersecurity and Infrastructure Security Agency) rating exploitation 'poc' (proof of concept public) for CVE-2026-110202 and CVE-2026-110204 and 'none' for CVE-2026-110203 and CVE-2026-110206; CVE-2026-110205 has no such assessment. As of 21 Oct 2026.",
   "new": "State: pending (no fix has shipped). No exploitation reported in the sources. The records carry a coordinator assessment by CISA (the US Cybersecurity and Infrastructure Security Agency) rating exploitation 'poc' (proof of concept public) for CVE-2026-110202 and CVE-2026-110204 and 'none' for CVE-2026-110203 and CVE-2026-110206; CVE-2026-110205 has no such assessment. As of 21 Oct 2026.",
   "reason": "Follows the editor's call H1 of 21 October 2026 (outcome 'pending' where no fix has shipped): the field's state label had not been updated with the outcome; the rest of the field is unchanged."
  },
  {
   "date": "2026-10-22",
   "field": "outcome.regime_consequence",
   "old": "CVE-2026-110202, CVE-2026-110203, CVE-2026-110204, CVE-2026-110205, CVE-2026-110206; no fixed version",
   "new": "none",
   "reason": "Rule 13 (new cases): the consequence line records only actions by a regulator, court, legislature or other government body; a CVE, an advisory, a score or a fix is not one. The CVE and fix details are already in the Evidence and Recovery fields, so nothing is lost. Found while drafting this case's letters, 22 October 2026."
  },
  {
   "date": "2026-10-22",
   "field": "named_parties[Roo Code].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-22\", \"response\": null}",
   "reason": "right of reply recorded by a human"
  },
  {
   "date": "2026-10-23",
   "field": "named_parties[Roo Code].right_of_reply",
   "old": "{\"offered\": \"2026-10-22\", \"response\": null}",
   "new": "{\"offered\": \"2026-10-22\", \"response\": null, \"acknowledged\": \"2026-10-23\"}",
   "reason": "right of reply recorded by a human"
  }
 ],
 "created": "2026-10-14",
 "last_reviewed": "2026-10-23",
 "reviewed_by": null,
 "derived_by": "agent"
}