CVE-2026-110204 in Roo Code
Summary
by MITRE • 10/13/2026
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
Roo Code versions through 3.54.0 are affected by a critical security flaw classified as a command approval bypass, which fundamentally undermines the integrity of its shell execution safeguards. The vulnerability stems from an incorrect implementation within the parseCommandLine() function, specifically regarding how it handles variable substitution and parameter expansion mechanisms in supported shells such as bash version 5.3 or later and ksh93. In these environments, the parser fails to distinguish between direct command invocations and indirect expansions that result in shell commands. This oversight allows an attacker who has gained control over input parameters to bypass explicit user approval workflows by embedding malicious payloads within seemingly benign, allowlisted commands.
The technical root cause lies in the misinterpretation of ${ command; } syntax as a standard parameter expansion rather than a potential code execution vector. When the application processes inputs containing this specific substitution pattern, it permits the enclosed shell commands to execute without triggering the necessary security checks or requiring user consent. This behavior creates a significant gap between the intended security policy and its actual enforcement, effectively rendering command allowlists ineffective against sophisticated injection techniques that leverage these parsing quirks.
Operationally, this vulnerability enables indirect prompt injection attacks where malicious actors can trick the system into executing arbitrary shell commands under the guise of legitimate operations. For instance, an attacker could embed a denied or restricted command inside an allowed command such as echo, exploiting the parser's failure to recursively validate the contents of parameter expansions. The impact is severe, potentially leading to unauthorized access to sensitive data, modification of critical files, or complete compromise of the underlying host system depending on the privileges held by the application process. This bypass mechanism effectively neutralizes defensive controls designed to restrict shell activity, allowing for stealthy and persistent exploitation without raising immediate alarms through standard approval logs.
To mitigate this risk, it is imperative to upgrade Roo Code to a version later than 3.54.0 where these parsing logic errors have been corrected. In the interim, administrators should enforce strict input validation that rejects any inputs containing shell substitution syntax such as dollar-sign curly braces when used in command contexts. Additionally, implementing allowlists at the operating system level using tools like sudoers with restricted commands can provide a secondary layer of defense by ensuring that even if application-level controls are bypassed, the underlying OS restricts execution to only explicitly permitted binaries and arguments. Aligning remediation efforts with CWE-78 Improper Neutralization of Special Elements used in an OS Command and ATT&CK technique T1059 Command and Scripting Interpreter will help ensure comprehensive protection against similar exploitation vectors.