# RooCodeInc Roo-Code.

Every CVE that names RooCodeInc Roo-Code among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position](https://agentprime.io/advisories/CVE-2026-110206.md)
  `CVE-2026-110206` · CVE record: RooCodeInc Roo-Code · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-436
- [Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution](https://agentprime.io/advisories/CVE-2026-110205.md)
  `CVE-2026-110205` · CVE record: RooCodeInc Roo-Code · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-184
- [Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution](https://agentprime.io/advisories/CVE-2026-110204.md)
  `CVE-2026-110204` · CVE record: RooCodeInc Roo-Code · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-436
- [Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization](https://agentprime.io/advisories/CVE-2026-110203.md)
  `CVE-2026-110203` · CVE record: RooCodeInc Roo-Code · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-436
- [Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping](https://agentprime.io/advisories/CVE-2026-110202.md)
  `CVE-2026-110202` · CVE record: RooCodeInc Roo-Code · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-436
- [Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch](https://agentprime.io/advisories/CVE-2026-82537.md)
  `CVE-2026-82537` · CVE record: RooCodeInc Roo-Code · CVSS 7.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-436
- [Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator](https://agentprime.io/advisories/CVE-2026-82536.md)
  `CVE-2026-82536` · CVE record: RooCodeInc Roo-Code · CVSS 7.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-184
- [RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal](https://agentprime.io/advisories/CVE-2026-81837.md)
  `CVE-2026-81837` · CVE record: RooCodeInc Roo-Code · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission](https://agentprime.io/advisories/CVE-2026-81836.md)
  `CVE-2026-81836` · CVE record: RooCodeInc Roo-Code · CVSS 6.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Weak cryptography or TLS, CWE-310
- [RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection](https://agentprime.io/advisories/CVE-2026-81835.md)
  `CVE-2026-81835` · CVE record: RooCodeInc Roo-Code · CVSS 5.1 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection, Code injection
- [RooCodeInc Roo-Code README File ExecaTerminalProcess code injection](https://agentprime.io/advisories/CVE-2026-81834.md)
  `CVE-2026-81834` · CVE record: RooCodeInc Roo-Code · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection, Code injection
- [RooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection](https://agentprime.io/advisories/CVE-2026-81833.md)
  `CVE-2026-81833` · CVE record: RooCodeInc Roo-Code · CVSS 5.1 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection, Code injection
- [Roo Code 3.54.0 Command Injection via Parameter Expansion Parsing](https://agentprime.io/advisories/CVE-2026-63108.md)
  `CVE-2026-63108` · CVE record: RooCodeInc Roo-Code · CVSS 7.7 High · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-184
- [Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug](https://agentprime.io/advisories/CVE-2025-65946.md)
  `CVE-2025-65946` · CVE record: RooCodeInc Roo-Code · CVSS 8.1 High · Not analysed yet · Published 21 Nov 2025 · Tags: Command injection, CWE-20
- [Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts](https://agentprime.io/advisories/CVE-2025-58374.md)
  `CVE-2025-58374` · CVE record: RooCodeInc Roo-Code · CVSS 7.8 High · Not analysed yet · Published 6 Sept 2025 · Tags: Command injection
- [Roo Code: Symlink-bypass of .rooignore can lead to unintended file disclosure](https://agentprime.io/advisories/CVE-2025-58373.md)
  `CVE-2025-58373` · CVE record: RooCodeInc Roo-Code · CVSS 5.5 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Path traversal
- [Roo Code: Potential Remote Code Execution via .code-workspace](https://agentprime.io/advisories/CVE-2025-58372.md)
  `CVE-2025-58372` · CVE record: RooCodeInc Roo-Code · CVSS 8.1 High · Not analysed yet · Published 5 Sept 2025 · Tags: Code injection, Broken access control
- [Roo Code is vulnerable to command injection via GitHub actions workflow](https://agentprime.io/advisories/CVE-2025-58371.md)
  `CVE-2025-58371` · CVE record: RooCodeInc Roo-Code · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2025 · Tags: Command injection
- [Roo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect Reference](https://agentprime.io/advisories/CVE-2025-58370.md)
  `CVE-2025-58370` · CVE record: RooCodeInc Roo-Code · CVSS 8.1 High · Not analysed yet · Published 5 Sept 2025 · Tags: Command injection
- [Roo-Code potential remote code execution via auto-execute command parsing flaw](https://agentprime.io/advisories/CVE-2025-57771.md)
  `CVE-2025-57771` · CVE record: RooCodeInc Roo-Code · CVSS 8.1 High · Not analysed yet · Published 22 Aug 2025 · Tags: Command injection
- [Roo Code Lacks Line Break Validation in its Command Execution Tool](https://agentprime.io/advisories/CVE-2025-54377.md)
  `CVE-2025-54377` · CVE record: RooCodeInc Roo-Code · CVSS 7.8 High · Not analysed yet · Published 23 Jul 2025 · Tags: Command injection
- [Roo Code allows Potential Remote Code Execution via .vscode/settings.json](https://agentprime.io/advisories/CVE-2025-53536.md)
  `CVE-2025-53536` · CVE record: RooCodeInc Roo-Code · CVSS 8.1 High · Not analysed yet · Published 7 Jul 2025 · Tags: Information disclosure
- [Roo Code Vulnerable to Potential Remote Code Execution via Model Context Protocol](https://agentprime.io/advisories/CVE-2025-53098.md)
  `CVE-2025-53098` · CVE record: RooCodeInc Roo-Code · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: Command injection
- [Roo Code extension vulnerable to Potential Information Leakage via JSON Schema](https://agentprime.io/advisories/CVE-2025-53097.md)
  `CVE-2025-53097` · CVE record: RooCodeInc Roo-Code · CVSS 5.9 Medium · Not analysed yet · Published 27 Jun 2025 · Tags: Other injection

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=roocodeinc-roo-code>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/roocodeinc-roo-code/>. Everything for agents: <https://agentprime.io/llms.txt>.