RooCodeInc Roo-Code

• CVE-2026-110206 High 8.8 Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position 0.5%
• CVE-2026-110205 High 8.8 Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution 0.5%
• CVE-2026-110204 High 8.8 Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution 0.5%
• CVE-2026-110203 High 8.8 Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization 0.5%
• CVE-2026-110202 High 8.8 Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping 0.4%
• CVE-2026-82537 High 8.8 Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch 0.5%
• CVE-2026-82536 High 8.8 Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator 0.5%
• CVE-2026-81837 Medium 6.3 RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal 0.5%
• CVE-2026-81836 Low 3.7 RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission 0.3%
• CVE-2026-81835 Medium 5.5 RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection 0.3%
• CVE-2026-81834 Medium 6.3 RooCodeInc Roo-Code README File ExecaTerminalProcess code injection 0.4%
• CVE-2026-81833 Medium 5.5 RooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection 0.3%
• CVE-2026-63108 High 8.8 Roo Code 3.54.0 Command Injection via Parameter Expansion Parsing 1.8%
• CVE-2025-65946 High 8.1 Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug 0.7%
• CVE-2025-58374 High 7.8 Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts 0.2%
• CVE-2025-58373 Medium 5.5 Roo Code: Symlink-bypass of .rooignore can lead to unintended file disclosure 0.3%
• CVE-2025-58372 High 8.1 Roo Code: Potential Remote Code Execution via .code-workspace 0.6%
• CVE-2025-58371 Critical 9.9 Roo Code is vulnerable to command injection via GitHub actions workflow 1.5%
• CVE-2025-58370 High 8.1 Roo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect Reference 0.4%
• CVE-2025-57771 High 8.1 Roo-Code potential remote code execution via auto-execute command parsing flaw 0.7%
• CVE-2025-54377 High 7.8 Roo Code Lacks Line Break Validation in its Command Execution Tool 1.1%
• CVE-2025-53536 High 8.1 Roo Code allows Potential Remote Code Execution via .vscode/settings.json 0.8%
• CVE-2025-53098 High 8.1 Roo Code Vulnerable to Potential Remote Code Execution via Model Context Protocol 0.7%
• CVE-2025-53097 Medium 5.9 Roo Code extension vulnerable to Potential Information Leakage via JSON Schema 0.5%