RooCodeInc Roo-Code vulnerabilities

CVEs per yearBy the year they were published

1. 202511
2. 202613

Newest CVEs

• CVE-2026-110206

  Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position

  RooCodeInc · Roo-Code

  High7.7
• CVE-2026-110205

  Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution

  RooCodeInc · Roo-Code

  High7.7
• CVE-2026-110204

  Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution

  RooCodeInc · Roo-Code

  High7.7
• CVE-2026-110203

  Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization

  RooCodeInc · Roo-Code

  High7.7
• CVE-2026-110202

  Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping

  RooCodeInc · Roo-Code

  High7.7
• CVE-2026-82537

  Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch

  RooCodeInc · Roo-Code

  High7.7
• CVE-2026-82536

  Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator

  RooCodeInc · Roo-Code

  High7.7
• CVE-2026-81837

  RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal

  RooCodeInc · Roo-Code

  Medium5.3
• CVE-2026-81836

  RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission

  RooCodeInc · Roo-Code

  Medium6.3
• CVE-2026-81835

  RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection

  RooCodeInc · Roo-Code

  Medium5.1