CVE-2026-81837
Received Received - Intake

Path Traversal in Roo-Code

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulDB

Description
A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been published and may be used. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-81837
EUVD
EUVD-2026-67286

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
roocodeinc roo-code to 3.51.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in Roo-Code up to version 3.51.1. The ApplyPatchTool component uses path.resolve to handle file paths without proper validation, allowing attackers to escape the intended workspace directory using sequences like '../'. This can let them modify arbitrary system files such as SSH keys or configuration files.

Detection Guidance

Check for suspicious patch files or modifications to system files like ~/.ssh/authorized_keys, shell configurations, or Git credentials. Review logs for unexpected path traversal sequences in Roo-Code operations.

Impact Analysis

An attacker could exploit this to modify sensitive files on your system, such as ~/.ssh/authorized_keys, which would grant them persistent SSH access. They could also alter shell configurations, Git credentials, or other critical files, potentially leading to full system compromise or data theft.

Mitigation Strategies

Stop using Roo-Code immediately as it is no longer supported. Implement strict path validation in any custom tools, block sensitive file paths, and add user confirmation prompts for file modifications. Consider sandboxing execution and logging patch applications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81837. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart