CVE-2026-110202 in Roo Code
Summary
by MITRE • 10/13/2026
Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo while the shell runs the denied command on the developer machine.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Roo Code versions through 3.54.0 represents a critical security flaw within its command execution decision-making logic, specifically located in the getCommandDecision function. This component is responsible for evaluating whether an incoming shell command should be permitted or denied based on predefined allowlists and safety policies. The core technical issue stems from insufficient validation of input prefixes before they are processed against these security rules. By exploiting this gap, attackers can bypass explicit denial decisions through a technique known as indirect prompt injection combined with shell syntax manipulation. Specifically, the vulnerability allows an attacker to auto-approve commands that would otherwise be blocked by simply prefixing them with a bare file descriptor redirect operator >& followed by a target string such as echo. This seemingly innocuous addition tricks the allowlist matcher into believing the command is benign because it matches allowed patterns like echo or other permitted utilities, while the underlying shell interpreter executes the actual malicious payload intended for execution on the developer machine.
From a technical perspective, this flaw exploits how modern shells parse and execute commands when combined with automated approval systems. The redirect operator >& typically redirects standard error to a file or another file descriptor, but in certain contexts within Roo Code’s parsing logic, it does not trigger the same security checks as direct command invocation. When an attacker injects a prompt that includes this prefix, the system evaluates the string after the redirect symbol against its allowlist rather than evaluating the entire command structure including the original denied action. This misalignment between what is evaluated for approval and what is actually executed creates a significant bypass mechanism. The attack vector relies on indirect injection, meaning the malicious input does not come directly from the user but is embedded within generated content or external data sources that feed into the AI model’s context window. Once processed, this injected text becomes part of the command string submitted to the shell interpreter, effectively circumventing human oversight and automated safety filters designed to prevent unauthorized system modifications or data exfiltration.
The operational impact of this vulnerability is severe for developers using Roo Code as an integrated development environment assistant. Since the tool operates with elevated privileges relative to standard application sandboxes, a successful exploit could lead to arbitrary code execution on the host machine. Attackers could potentially install malware, steal sensitive source code or credentials, pivot into internal networks if network access is available, or disrupt ongoing development workflows by corrupting project files. The ability to auto-approve denied commands undermines the fundamental trust model of AI-assisted coding tools, where developers rely on the system to enforce safety boundaries automatically. This bypass effectively neutralizes protective measures intended to prevent accidental or malicious execution of dangerous shell operations such as rm -rf /, wget from untrusted sources, or executing scripts with root privileges.
This vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command and CWE-200 Exposure of Sensitive Information if the executed commands lead to data leakage. In terms of MITRE ATT&CK framework classification, this behavior corresponds to T1620 Abuse Execution Guardrails which involves bypassing mechanisms designed to restrict command execution, as well as T1059 Command and Scripting Interpreter for the actual exploitation phase where shell scripts or commands are executed on the target system. The use of indirect prompt injection also maps to techniques observed in LLM-based attacks where malicious instructions are hidden within legitimate-looking text to manipulate model behavior without triggering standard detection heuristics.
Mitigation strategies must focus on strengthening input validation and command parsing logic within the getCommandDecision function. Developers should implement strict allowlisting that evaluates the entire command string including any prefixes or modifiers rather than just the primary executable name. Additionally, implementing a whitelist of allowed file descriptors for redirects can prevent abuse of operators like >& to mask malicious intent. It is crucial to sanitize all inputs derived from external sources before they are passed to shell interpreters, ensuring that no unexpected characters alter execution flow. Upgrading to patched versions where this logic has been corrected is the primary remediation step. Furthermore, organizations should enforce principle of least privilege by running Roo Code in restricted environments with limited system access and monitoring for anomalous command patterns that deviate from expected development activities. Regular security audits of AI-assisted tools are essential to identify similar bypass vectors before they can be exploited in production environments.