CVE-2025-58371
BaseFortify
Publication date: 2025-09-05
Last updated on: 2025-09-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| roocode | roo_code | to 3.26.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Roo Code versions 3.26.6 and below, where a GitHub workflow uses unsanitized pull request metadata in a privileged context. This allows an attacker to craft malicious input that leads to Remote Code Execution (RCE) on the Actions runner. Because the workflow runs with broad permissions and access to repository secrets, the attacker can execute arbitrary commands, push or modify code, access secrets, and create malicious releases or packages, resulting in a complete compromise of the repository and its associated services. The issue is fixed in version 3.26.7.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Roo Code to version 3.26.7 or later, as this version contains the fix for the vulnerability. Avoid using versions 3.26.6 and below. Additionally, review and restrict permissions of GitHub workflows to limit access to repository secrets and privileged contexts.
How can this vulnerability impact me? :
This vulnerability can lead to a complete compromise of your repository and associated services. An attacker can execute arbitrary commands on the Actions runner, push or modify code in your repository, access sensitive secrets, and create malicious releases or packages. This can result in unauthorized code changes, data breaches, and potentially widespread damage to your software supply chain.