CVE-2026-63108 in Roo Code
Summary
by MITRE • 07/20/2026
Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter expansions with opaque placeholders before extracting command substitutions, causing the containsDangerousSubstitution guard to miss nested payloads, which are then auto-approved based on the outer allowlisted command prefix and executed by the shell via execa, enabling arbitrary command execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability described represents a critical command injection flaw in Roo Code versions up to 3.54.0 that fundamentally undermines the security controls designed to prevent unauthorized command execution. This issue resides within the auto-approve execute feature where the system attempts to enforce allowlist and denylist policies by validating command prefixes before execution. However, the implementation contains a significant logical flaw in how parameter expansions are processed, creating an exploitable gap in the security architecture that directly violates the principle of least privilege and proper input validation.
The technical root cause stems from the command parsing logic implemented in parse-command.ts which performs a two-stage processing approach. Initially, parameter expansions are replaced with opaque placeholders to facilitate parsing, but this preprocessing step occurs before the dangerous substitution detection mechanism can properly analyze nested command structures. The containsDangerousSubstitution guard operates on the pre-processed command string that has already had parameter expansions substituted with placeholders, thereby missing nested payloads that exist within these parameter expansion defaults. This creates a scenario where attackers can craft malicious inputs that appear benign to the initial validation but contain hidden command injection elements that only become apparent after the placeholder replacement process.
The operational impact of this vulnerability is severe and directly enables arbitrary code execution within the system's execution context. When an attacker crafts a payload with nested command substitutions inside parameter expansion defaults, the outer command prefix may match an allowlisted pattern, causing the system to auto-approve the execution without proper security scrutiny. The execa library then executes these commands through the shell, bypassing all intended security controls and allowing full system compromise. This vulnerability aligns with CWE-78 which specifically addresses improper neutralization of special elements used in OS commands, representing a classic command injection attack vector that has been successfully exploited in numerous enterprise environments.
The attack surface extends beyond simple command execution to include potential privilege escalation and persistence mechanisms within the target environment. Attackers can leverage this vulnerability to execute arbitrary shell commands with the privileges of the executing process, potentially leading to complete system compromise or data exfiltration. The flaw demonstrates poor input sanitization practices and highlights the importance of proper parsing order in security-critical code paths. Organizations implementing Roo Code should immediately consider mitigating actions including immediate version upgrades, implementing additional command validation layers, and reviewing all auto-approve configurations to prevent unauthorized execution of potentially malicious commands.
Security controls designed around allowlist/denylist enforcement become fundamentally ineffective when such logical flaws exist in the parsing pipeline. This vulnerability illustrates why defense-in-depth strategies are essential and why automated security tools alone cannot detect all potential injection vectors. The issue also aligns with several ATT&CK techniques including T1059 Command and Scripting Interpreter and T1203 Exploitation for Client Execution, demonstrating how seemingly legitimate system features can be exploited to achieve unauthorized code execution. Organizations should implement comprehensive logging of command execution attempts, establish strict parameter validation rules, and consider adopting more robust parsing mechanisms that can properly detect nested command structures before any execution occurs.
The vulnerability underscores critical gaps in the security review process and highlights the need for thorough testing of edge cases involving parameter expansion and substitution logic. Proper implementation would require maintaining the original structure information during placeholder replacement or implementing more sophisticated pattern matching that accounts for nested command substitutions. This flaw serves as a reminder that security measures must account for complex parsing scenarios where simple validation can be bypassed through clever input construction, emphasizing the importance of threat modeling and comprehensive security testing in development lifecycle processes.