Roo Code: crafted shell commands pass the coding agent's command allowlist and run without user approval; five CVEs published 13 October 2026, project archived with no fix
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | A developer running Roo Code with auto-approval of allowlisted shell commands enabled | fact | NVD record CVE-2026-110205: Roo Code through 3.54.0 command approval bypass (command substitution next to a glob character discarded), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck | high |
| Mandate: objective | not evidenced in source | assertion | NVD record CVE-2026-110202: Roo Code through 3.54.0 command approval bypass (bare >& redirect prefix), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110203: Roo Code through 3.54.0 command approval bypass (quote-masking regex in parseCommandLine()), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110204: Roo Code through 3.54.0 command approval bypass (${ command; } substitution treated as parameter expansion), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110205: Roo Code through 3.54.0 command approval bypass (command substitution next to a glob character discarded), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110206: Roo Code through 3.54.0 command approval bypass (command substitution in command position), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck | low |
| Actor | Roo Code through 3.54.0, which runs shell commands on the developer machine and decides through getCommandDecision() and parseCommandLine() whether a command is auto-approved | fact | NVD record CVE-2026-110202: Roo Code through 3.54.0 command approval bypass (bare >& redirect prefix), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110203: Roo Code through 3.54.0 command approval bypass (quote-masking regex in parseCommandLine()), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110204: Roo Code through 3.54.0 command approval bypass (${ command; } substitution treated as parameter expansion), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110205: Roo Code through 3.54.0 command approval bypass (command substitution next to a glob character discarded), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110206: Roo Code through 3.54.0 command approval bypass (command substitution in command position), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck | high |
| Inputs | Described, not demonstrated: the records say attackers using indirect prompt injection can lead the agent to propose a crafted shell command; the reporters' write-ups call this 'the realistic trigger', and their proofs of concept call the approval code directly rather than going through the agent | fact | NVD record CVE-2026-110202: Roo Code through 3.54.0 command approval bypass (bare >& redirect prefix), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110203: Roo Code through 3.54.0 command approval bypass (quote-masking regex in parseCommandLine()), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110204: Roo Code through 3.54.0 command approval bypass (${ command; } substitution treated as parameter expansion), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110205: Roo Code through 3.54.0 command approval bypass (command substitution next to a glob character discarded), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110206: Roo Code through 3.54.0 command approval bypass (command substitution in command position), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; 7rah/oss-cve on GitHub, commit 6adb836: "add 5 Roo-Code auto-approve bypass advisories" (the researcher disclosure write-ups, with proofs of concept, cited by each of the five records) | high |
| Decision | The approval check matched the crafted command to an allowlisted prefix such as echo and auto-approved it, while the shell would run a denied command: a bare >& redirect prefix (110202); escaped or single-quoted double quotes defeating the quote-masking regex (110203); ${ command; } substitutions treated as parameter expansions on bash 5.3+ or ksh93 (110204); command substitutions next to * or ? discarded (110205); a command substitution in command position (110206) | fact | NVD record CVE-2026-110202: Roo Code through 3.54.0 command approval bypass (bare >& redirect prefix), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110203: Roo Code through 3.54.0 command approval bypass (quote-masking regex in parseCommandLine()), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110204: Roo Code through 3.54.0 command approval bypass (${ command; } substitution treated as parameter expansion), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110205: Roo Code through 3.54.0 command approval bypass (command substitution next to a glob character discarded), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110206: Roo Code through 3.54.0 command approval bypass (command substitution in command position), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck | high |
| Envelope: constraints | A command allowlist and denylist enforced by the agent's own parser, which interprets command lines differently from the shell that runs them | fact | NVD record CVE-2026-110202: Roo Code through 3.54.0 command approval bypass (bare >& redirect prefix), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110203: Roo Code through 3.54.0 command approval bypass (quote-masking regex in parseCommandLine()), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110204: Roo Code through 3.54.0 command approval bypass (${ command; } substitution treated as parameter expansion), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110205: Roo Code through 3.54.0 command approval bypass (command substitution next to a glob character discarded), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110206: Roo Code through 3.54.0 command approval bypass (command substitution in command position), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck | high |
| Action | The shell runs the denied command on the developer machine without user approval | fact | NVD record CVE-2026-110202: Roo Code through 3.54.0 command approval bypass (bare >& redirect prefix), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110203: Roo Code through 3.54.0 command approval bypass (quote-masking regex in parseCommandLine()), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110204: Roo Code through 3.54.0 command approval bypass (${ command; } substitution treated as parameter expansion), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110205: Roo Code through 3.54.0 command approval bypass (command substitution next to a glob character discarded), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110206: Roo Code through 3.54.0 command approval bypass (command substitution in command position), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck | high |
| Outcome | State: pending (no fix has shipped). No exploitation reported in the sources. The records carry a coordinator assessment by CISA (the US Cybersecurity and Infrastructure Security Agency) rating exploitation 'poc' (proof of concept public) for CVE-2026-110202 and CVE-2026-110204 and 'none' for CVE-2026-110203 and CVE-2026-110206; CVE-2026-110205 has no such assessment. As of 21 Oct 2026. | assertion | NVD record CVE-2026-110202: Roo Code through 3.54.0 command approval bypass (bare >& redirect prefix), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110203: Roo Code through 3.54.0 command approval bypass (quote-masking regex in parseCommandLine()), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110204: Roo Code through 3.54.0 command approval bypass (${ command; } substitution treated as parameter expansion), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110205: Roo Code through 3.54.0 command approval bypass (command substitution next to a glob character discarded), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110206: Roo Code through 3.54.0 command approval bypass (command substitution in command position), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck | medium |
| Evidence: event | Five CVE (Common Vulnerabilities and Exposures) records published on 13 October 2026 by VulnCheck, the numbering authority, and shown in the National Vulnerability Database (NVD), affected versions through 3.54.0; VulnCheck scored each 7.7 under CVSS (Common Vulnerability Scoring System) version 4.0 and 8.8 under CVSS version 3.1. The write-ups each record cites contain proof-of-concept runs of the two unmodified approval source files and of bash, not of the running agent. An earlier record, CVE-2026-82536 (8 September 2026), describes the same kind of bypass through the |& operator (a pipe carrying both standard output and standard error) in the same versions | fact | NVD record CVE-2026-110202: Roo Code through 3.54.0 command approval bypass (bare >& redirect prefix), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110203: Roo Code through 3.54.0 command approval bypass (quote-masking regex in parseCommandLine()), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110204: Roo Code through 3.54.0 command approval bypass (${ command; } substitution treated as parameter expansion), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110205: Roo Code through 3.54.0 command approval bypass (command substitution next to a glob character discarded), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110206: Roo Code through 3.54.0 command approval bypass (command substitution in command position), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; VulnCheck advisory CVE-2026-82536: Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator; 7rah/oss-cve on GitHub, commit 6adb836: "add 5 Roo-Code auto-approve bypass advisories" (the researcher disclosure write-ups, with proofs of concept, cited by each of the five records) | high |
| Recovery: technical | No fixed version is named in the records, and each record carries the tag 'unsupported-when-assigned' (the product was no longer supported by its maintainer when the identifier was assigned). The vendor's repository was archived by its owner on 15 May 2026 and is read-only; v3.54.0, released 15 May, is its latest release. The extension's Visual Studio Code Marketplace listing, still at version 3.54.0, says 'The Roo Code Extension was shut down on May 15th' | fact | NVD record CVE-2026-110202: Roo Code through 3.54.0 command approval bypass (bare >& redirect prefix), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110203: Roo Code through 3.54.0 command approval bypass (quote-masking regex in parseCommandLine()), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110204: Roo Code through 3.54.0 command approval bypass (${ command; } substitution treated as parameter expansion), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110205: Roo Code through 3.54.0 command approval bypass (command substitution next to a glob character discarded), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; NVD record CVE-2026-110206: Roo Code through 3.54.0 command approval bypass (command substitution in command position), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck; RooCodeInc/Roo-Code releases page on GitHub: repository archived by the owner on 15 May 2026; latest release v3.54.0; Roo Code - Visual Studio Marketplace | high |
| Recovery: accountability | No vendor statement about these five records was found. In August 2026, answering other Roo Code vulnerability reports filed through VulDB, the vendor said they 'all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it' (as quoted by VulDB in CVE-2026-81834) | assertion | NVD record CVE-2026-81834: RooCodeInc Roo-Code up to 3.51.1 code injection (VulDB record quoting the vendor that Roo Code is a project it no longer supports) | medium |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Mechanism: the pre-execution approval check parsed each crafted command as an allowlisted one (for example echo) while the shell executed a denied command. Why it interrupts: a check that resolves the command the way the shell will (or refuses what it cannot parse) would have sent these commands to the user instead of auto-approving them. Source shows it failed: all five records describe the check approving the command. | C-D1 Pre-execution validation |
| failed | Mechanism: the records name indirect prompt injection as the route by which attacker content becomes the command the agent proposes. Why it interrupts: if retrieved content were never treated as instruction, the attacker could not choose the command. Source shows it failed only by naming the route: the reporters' proofs of concept call the approval code directly and do not exercise this route; the counterfactual is not shown. | C-I1 Retrieved content as data |
Inference
inference The five records describe one approval check, in getCommandDecision() and parseCommandLine(), that reads a command line differently from the shell that runs it, so a command the check takes for an allowlisted one such as echo is auto-approved while the shell runs a different command. The reporters showed this by running the approval code and bash directly, not through the agent. The records do not show an attack through the running agent, any exploitation, whether the vendor was told before publication, or a fix; the product had been shut down and was unsupported when the identifiers were assigned.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| NVD-110202 | NVD record CVE-2026-110202: Roo Code through 3.54.0 command approval bypass (bare >& redirect prefix), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck | public record primary record | nvd.nist.gov ↗ checked 2026-10-21 |
| NVD-110203 | NVD record CVE-2026-110203: Roo Code through 3.54.0 command approval bypass (quote-masking regex in parseCommandLine()), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck | public record primary record | nvd.nist.gov ↗ checked 2026-10-21 |
| NVD-110204 | NVD record CVE-2026-110204: Roo Code through 3.54.0 command approval bypass (${ command; } substitution treated as parameter expansion), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck | public record primary record | nvd.nist.gov ↗ checked 2026-10-21 |
| NVD-110205 | NVD record CVE-2026-110205: Roo Code through 3.54.0 command approval bypass (command substitution next to a glob character discarded), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck | public record primary record | nvd.nist.gov ↗ checked 2026-10-21 |
| NVD-110206 | NVD record CVE-2026-110206: Roo Code through 3.54.0 command approval bypass (command substitution in command position), CVSS 4.0 score 7.7 and CVSS 3.1 score 8.8, both from VulnCheck | public record primary record | nvd.nist.gov ↗ checked 2026-10-21 |
| VC-82536 | VulnCheck advisory CVE-2026-82536: Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator | researcher primary record | vulncheck.com ↗ checked 2026-10-21 |
| REPO | RooCodeInc/Roo-Code releases page on GitHub: repository archived by the owner on 15 May 2026; latest release v3.54.0 | company primary record | github.com ↗ checked 2026-10-21 |
| RESEARCHER | 7rah/oss-cve on GitHub, commit 6adb836: "add 5 Roo-Code auto-approve bypass advisories" (the researcher disclosure write-ups, with proofs of concept, cited by each of the five records) | researcher primary record | github.com ↗ checked 2026-10-21 |
| MARKETPLACE | Roo Code - Visual Studio Marketplace (interest: vendor describing its own product) | company primary record | marketplace.visualstudio.com ↗ checked 2026-10-21 |
| NVD-81834 | NVD record CVE-2026-81834: RooCodeInc Roo-Code up to 3.51.1 code injection (VulDB record quoting the vendor that Roo Code is a project it no longer supports) | public record primary record | nvd.nist.gov ↗ checked 2026-10-21 |