Advisories · Technology
RooCodeInc Roo-Code.
Every CVE that names RooCodeInc Roo-Code among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.7 High
Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position
- RooCodeInc Roo-Code
- CWE-436
- CVSS 7.7 High
Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution
- RooCodeInc Roo-Code
- CWE-184
- CVSS 7.7 High
Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution
- RooCodeInc Roo-Code
- CWE-436
- CVSS 7.7 High
Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization
- RooCodeInc Roo-Code
- CWE-436
- CVSS 7.7 High
Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping
- RooCodeInc Roo-Code
- CWE-436
- CVSS 7.7 High
Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch
- RooCodeInc Roo-Code
- CWE-436
- CVSS 7.7 High
Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator
- RooCodeInc Roo-Code
- CWE-184
- CVSS 5.3 Medium
RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal
- RooCodeInc Roo-Code
- Path traversal
- CVSS 6.3 Medium
RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission
- RooCodeInc Roo-Code
- Weak cryptography or TLS
- CWE-310
- CVSS 5.1 Medium
RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection
- RooCodeInc Roo-Code
- Other injection
- Code injection
- CVSS 5.3 Medium
RooCodeInc Roo-Code README File ExecaTerminalProcess code injection
- RooCodeInc Roo-Code
- Other injection
- Code injection
- CVSS 5.1 Medium
RooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection
- RooCodeInc Roo-Code
- Other injection
- Code injection
- CVSS 7.7 High
Roo Code 3.54.0 Command Injection via Parameter Expansion Parsing
- RooCodeInc Roo-Code
- CWE-184
- CVSS 8.1 High
Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug
- RooCodeInc Roo-Code
- Command injection
- CWE-20
- CVSS 7.8 High
Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts
- RooCodeInc Roo-Code
- Command injection
- CVSS 5.5 Medium
Roo Code: Symlink-bypass of .rooignore can lead to unintended file disclosure
- RooCodeInc Roo-Code
- Path traversal
- CVSS 8.1 High
Roo Code: Potential Remote Code Execution via .code-workspace
- RooCodeInc Roo-Code
- Code injection
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Roo Code is vulnerable to command injection via GitHub actions workflow
- RooCodeInc Roo-Code
- Command injection
- CVSS 8.1 High
Roo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect Reference
- RooCodeInc Roo-Code
- Command injection
- CVSS 8.1 High
Roo-Code potential remote code execution via auto-execute command parsing flaw
- RooCodeInc Roo-Code
- Command injection
- CVSS 7.8 High
Roo Code Lacks Line Break Validation in its Command Execution Tool
- RooCodeInc Roo-Code
- Command injection
- CVSS 8.1 High
Roo Code allows Potential Remote Code Execution via .vscode/settings.json
- RooCodeInc Roo-Code
- Information disclosure
- CVSS 8.1 High
Roo Code Vulnerable to Potential Remote Code Execution via Model Context Protocol
- RooCodeInc Roo-Code
- Command injection
- CVSS 5.9 Medium
Roo Code extension vulnerable to Potential Information Leakage via JSON Schema
- RooCodeInc Roo-Code
- Other injection