CVE-2025-53098
BaseFortify
Publication date: 2025-06-27
Last updated on: 2025-09-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| roocode | roo_code | to 3.20.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Roo Code, an AI-powered autonomous coding agent. Before version 3.20.3, the agent's MCP configuration file (.roo/mcp.json) could be manipulated by an attacker who could craft a prompt to make the agent write malicious commands into this configuration file. If the user had enabled auto-approving file writes (which is off by default), this could lead to arbitrary command execution. The vulnerability requires the attacker to already have the ability to submit prompts to the agent and for the user to have MCP enabled and auto-approve file writes. Version 3.20.3 fixes this by adding an extra opt-in layer for auto-approving writes to configuration files.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker to execute arbitrary commands on your system via the Roo Code agent. This could lead to unauthorized actions or compromise of your environment, but exploitation requires the attacker to submit prompts to the agent, MCP to be enabled, and auto-approval of file writes to be turned on by the user.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update Roo Code to version 3.20.3 or later, which adds an additional opt-in configuration layer for auto-approving writes to configuration files. Additionally, ensure that auto-approved file writes are disabled (off by default) unless explicitly needed, and avoid enabling MCP auto-approval without careful consideration.