CVE-2026-81833

Received Received - Intake

Code Injection in Roo-Code

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulDB

Description

A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/helpers.ts of the component CodeIndexManager. Performing a manipulation results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-81833

Affected Vendors & Products

Vendor	Product	Version / Range
roocodeinc	roo-code	3.51.1
roocodeinc	roo-code	to 3.51.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-81833 is a code injection vulnerability in RooCodeInc Roo-Code up to version 3.51.1. The flaw exists in the optimizeQuery function of src/utils/helpers.ts within the CodeIndexManager component. Attackers can exploit this by injecting malicious code through comments in files, which the system then executes automatically without proper validation.

Detection Guidance

Detecting this vulnerability requires checking for the presence of Roo-Code versions up to 3.51.1 and inspecting code comments for malicious commands. Review git history and indexed files for suspicious comments containing executable instructions. Use commands like grep to search for known exploit patterns in comments or logs.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on your system. It can lead to credential theft (AWS keys, SSH keys, environment secrets), data exfiltration, or further compromise of your development environment. The attack is stealthy as it hides in code comments and exploits normal workflows.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade to a supported version or discontinue use of Roo-Code as it is no longer maintained. Implement input sanitization for code comments during indexing and enforce user approval for command execution. Monitor for unauthorized credential exfiltration and review RAG retrieval logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-81833. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70