CVE-2026-110206

Analyzed Analyzed - Analysis Complete

Command Approval Bypass in Roo Code

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $(echo touch /tmp/x) that pass the echo allowlist check, causing the shell to execute the output without user approval.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110206

EUVD

EUVD-2026-99247

Affected Vendors & Products

Vendor	Product	Version / Range
roocode	roo_code	to 3.54.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-436	Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

Executive Summary

Roo Code through 3.54.0 has a flaw in parseCommandLine() where attackers can bypass command approval by using command substitution. For example, a command like $(echo touch /tmp/x) tricks the system into executing the output (touch /tmp/x) directly in the shell. The approval system only checks the inner command (echo) which may be allowlisted, but the executed command is the substitution output, allowing arbitrary execution.

Detection Guidance

To detect this vulnerability, check if Roo Code versions up to 3.54.0 are installed. Inspect logs for command substitutions like $(echo touch /tmp/x) being executed without user approval. Monitor for unexpected file creations or system changes in /tmp or other directories.

Impact Analysis

Attackers could exploit this via indirect prompt injection to run malicious commands with the application's privileges. This could lead to unauthorized file creation, data exfiltration, or system compromise. Users relying on the auto-approve feature may unknowingly execute harmful commands.

Mitigation Strategies

Immediately upgrade Roo Code to a patched version beyond 3.54.0. Disable the 'always approve execute' feature if enabled. Review and update allow/deny lists to block command substitutions at command position. Implement strict input validation for indirect prompt injection vectors.

Hi! I’m here to help you understand CVE-2026-110206. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70