CVE-2026-110205

Analyzed Analyzed - Analysis Complete

Command Approval Bypass in Roo Code

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110205

EUVD

EUVD-2026-99246

Affected Vendors & Products

Vendor	Product	Version / Range
roocode	roo_code	to 3.54.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

Roo Code through 3.54.0 has a vulnerability where command substitutions like $(...) placed next to glob characters such as * or ? are discarded during parsing. This allows attackers to bypass the auto-approval mechanism by crafting commands that match allowlisted prefixes, executing unauthorized commands without user approval when auto-approval is enabled.

Detection Guidance

Check Roo Code version with command: roo-code --version. If version is <=3.54.0, the system is vulnerable. Monitor for unexpected command executions or file creations in /tmp or other directories. Test by attempting to run echo *$(touch /tmp/ROO_PWNED) and verify if the file is created despite deny lists.

Inspect Roo Code logs for auto-approved commands containing glob characters (* or ?) followed by command substitutions ($(...)). Look for patterns where substitutions are adjacent to globs.

Impact Analysis

This vulnerability enables indirect prompt injection attacks, where untrusted input could trick the system into executing malicious commands with elevated privileges. Attackers could create files, exfiltrate data, or perform other unauthorized actions on the system.

Compliance Impact

This vulnerability allows unauthorized command execution bypassing approval mechanisms, which could lead to unauthorized data access, modification, or exfiltration. For GDPR, this may violate principles of data protection by design and default. For HIPAA, it could enable unauthorized access to protected health information.

Mitigation Strategies

Upgrade Roo Code to a version beyond 3.54.0 immediately. Disable the auto-approval feature if not essential. Review and update allow/deny lists to include patterns with glob characters and command substitutions.

Implement strict input validation for commands containing globs or substitutions. Monitor for suspicious activity in logs and restrict file system access for the Roo Code process.

Hi! I’m here to help you understand CVE-2026-110205. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70