CVE-2026-82536 in Roo-Code
Summary
by MITRE • 09/09/2026
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line with an allowlisted prefix followed by the stderr-redirecting pipe operator and a denied command, causing the parser to approve the full pipeline while bash executes the denied component with the agent's auto-execute privileges on the developer's machine.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in Roo-Code versions through 3.54.0 represents a critical security flaw within its shell command parsing logic, specifically categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command. This auto-approve bypass mechanism allows attackers to execute commands that are explicitly denied by the application's safety policies. The root cause lies in the incomplete definition of operator tokens recognized by the parser. By omitting specific shell operators from its validation set, particularly those related to output redirection and piping, the system fails to properly sanitize or reject complex command structures that attempt to circumvent access controls.
The technical exploitation vector relies on the behavior of the Bash shell regarding standard error streams. An attacker can construct a malicious command line that begins with an allowlisted prefix, which passes initial validation checks due to its benign appearance. Following this prefix, the attacker inserts the stderr-redirecting pipe operator followed by a denied command. Because the parser does not recognize or validate the redirector as part of the command structure requiring strict scrutiny, it approves the entire pipeline based on the allowed prefix. However, when Bash executes this approved string, it interprets the redirection and subsequent commands correctly, thereby executing the restricted operation with the agent's elevated auto-execute privileges on the developer's machine.
This flaw has significant operational impact as it effectively neutralizes the intended security boundaries of the Roo-Code environment. Developers relying on these safety mechanisms to prevent accidental or malicious system modifications are exposed to potential compromise. The ability to execute denied commands means that an attacker, potentially through a compromised AI agent interaction or injected prompt, can perform unauthorized file operations, install software, exfiltrate data, or pivot further into the network using the credentials and permissions of the active user session. This aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving shell commands, as it demonstrates how a trusted application can be leveraged to execute arbitrary code under false pretenses.
Mitigation strategies must focus on hardening the command parsing logic to ensure comprehensive coverage of all relevant shell operators. The immediate remediation involves updating Roo-Code to a version where this vulnerability is patched and the operator token set is expanded to include stderr redirection symbols such as 2>. Additionally, developers should implement strict allowlisting for specific commands rather than relying solely on prefix matching, which can be easily bypassed using chaining techniques like pipes or semicolons. Enforcing least-privilege principles by restricting the execution environment of auto-approved commands further reduces the blast radius in case of a successful exploitation attempt. Regular security audits of input validation logic are essential to prevent similar oversights in future releases.