CVE-2026-110206 in Roo Code
Summary
by MITRE • 10/13/2026
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $(echo touch /tmp/x) that pass the echo allowlist check, causing the shell to execute the output without user approval.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Roo Code versions through 3.54.0 represents a critical security flaw within its command parsing logic, specifically located in the parseCommandLine function. This issue stems from an insufficient validation mechanism when processing user inputs that are intended to trigger shell commands. The core of the problem lies in how the application handles indirect prompt injection scenarios where attackers can manipulate the input stream to bypass existing allowlists and approval workflows. By exploiting this flaw, malicious actors can execute arbitrary system-level commands without requiring explicit human authorization, effectively neutralizing a primary defense layer designed to prevent unauthorized code execution.
Technically, the vulnerability arises from the interaction between command substitution syntax and the application's filtering rules. Roo Code employs an allowlist strategy to determine which shell commands are permissible for automatic approval. However, this check is performed on the raw input string before it is fully resolved by the underlying shell environment. An attacker can craft a payload using standard Unix command substitution syntax, such as $(echo touch /tmp/x), and place it in the position where a direct command name would normally appear. Because the allowlist checker evaluates the literal text of the input rather than its semantic meaning or final execution state, it sees only the allowed keyword echo within the parentheses. Consequently, the system grants automatic approval to this seemingly benign construct. Once approved, the shell interprets the command substitution and executes the resulting output, which in this case is a new file creation operation, thereby achieving arbitrary code execution under the guise of an authorized action.
The operational impact of this vulnerability is severe, as it allows for complete compromise of the host system's integrity when Roo Code is run with elevated privileges or access to sensitive data. An attacker leveraging indirect prompt injection can trick the application into executing malicious scripts, exfiltrating confidential information, installing backdoors, or pivoting to other systems within a networked environment. This bypasses the principle of least privilege and undermines user trust in automated tooling that relies on explicit consent for risky operations. The ability to auto-approve arbitrary commands means that even users who are cautious about granting permissions can be exploited if they interact with compromised prompts or maliciously crafted inputs, leading to potential data breaches, system instability, and unauthorized administrative access.
To mitigate this risk, immediate updates to Roo Code beyond version 3.54.0 are strongly recommended as the vendor has likely addressed the parsing logic in subsequent releases. In environments where updating is not immediately feasible, administrators should enforce strict input sanitization at the application level rather than relying solely on allowlists of command names. Implementing a whitelist approach that validates both the command and its arguments against known safe patterns can reduce exposure. Additionally, running Roo Code with restricted user privileges limits the blast radius of any successful exploitation. Security teams should also monitor for unusual shell activity originating from automated tools and consider implementing runtime application self-protection mechanisms to detect anomalous command execution patterns indicative of this specific bypass technique. This vulnerability is classified under CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection, and aligns with ATT&CK techniques related to Execution via Remote Services or Local Application Hijacking depending on the deployment context.