CVE-2026-110205 in Roo-Code
Summary
by MITRE • 10/13/2026
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Roo Code versions through 3.54.0 represents a critical command execution bypass rooted in the improper parsing of shell glob characters within the parseCommandLine function. This flaw allows an attacker to circumvent security controls designed to restrict unauthorized command execution, specifically when auto-approval features are enabled for certain allowlisted prefixes. The core technical issue lies in how the application processes wildcard patterns such as asterisks and question marks during the validation phase. When a user or system component submits a command string containing these glob characters alongside shell substitution syntax, the parser fails to correctly identify the embedded malicious payload. Instead of rejecting the input due to the presence of potentially dangerous subshell execution commands, the parsing logic discards the substitutions that are positioned adjacent to the wildcard patterns. This behavior creates a discrepancy between what is visually presented or intended and what is actually executed by the underlying shell environment.
From an operational perspective, this vulnerability enables indirect prompt injection attacks where external inputs can manipulate the application into executing arbitrary system commands without explicit user consent. By crafting input strings that combine allowlisted prefixes with glob characters and command substitutions, such as echo *$(malicious_command), attackers can trick the auto-approval mechanism into granting permission for actions that should otherwise be denied. The presence of the wildcard character masks the subsequent substitution syntax from the initial validation checks, allowing the shell to interpret and execute the substituted content after the security filter has already passed the command based on its prefix match. This effectively neutralizes the protective barrier provided by allowlisting, as the actual executed payload differs significantly from what was approved or permitted under normal circumstances.
This flaw aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The specific mechanism involves a failure to properly sanitize or validate input before passing it to a downstream component that interprets special characters. Furthermore, the exploitation technique relates to ATT&CK tactic T1059 Command and Scripting Interpreter, specifically sub-techniques involving shell commands like sh or bash. The ability to bypass approval mechanisms also touches upon CWE-284 Improper Access Control, as it allows unauthorized execution of system-level operations that were explicitly restricted by the application's security policy. In environments where Roo Code is used for automated coding tasks or development workflows, this vulnerability poses a severe risk because auto-approval features are often relied upon to streamline repetitive but safe-looking commands. An attacker who can inject prompts into the context window could potentially exfiltrate data, install malware, or pivot further within the host system by leveraging these unrestricted command executions.
Mitigation strategies must focus on correcting the parsing logic in the parseCommandLine function to ensure that all components of a command string are validated against security policies before execution. Developers should implement strict input validation that accounts for shell metacharacters and substitution syntax, ensuring that allowlists do not inadvertently permit dangerous patterns through wildcard masking. Additionally, relying solely on auto-approval for complex commands is risky; implementing multi-factor approval or requiring explicit user confirmation for any command involving subshells would significantly reduce the attack surface. Updating to a patched version of Roo Code as soon as it becomes available is essential, along with auditing existing configurations to disable auto-approval for high-risk operations until the underlying parsing defect is resolved.