CVE-2026-110205

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-110205
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/7rah/oss-cve/blob/6adb836d24ca446fd168c3acdc4c170beb77fe0f/roocode-glob-token.md Exploit Mitigation Third Party Advisory
https://github.com/RooCodeInc/Roo-Code/blob/v3.54.0/src/shared/parse-command.ts#L148-L172 Product
https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-glob-token-discarding-command-substitution Third Party Advisory
https://github.com/7rah/oss-cve/blob/6adb836d24ca446fd168c3acdc4c170beb77fe0f/roocode-glob-token.md Exploit Mitigation Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:roocode:roo_code:*:*:*:*:*:*:*:*
History

26 Oct 2026, 20:17

Type Values Removed Values Added
References () https://github.com/7rah/oss-cve/blob/6adb836d24ca446fd168c3acdc4c170beb77fe0f/roocode-glob-token.md - Exploit, Mitigation, Third Party Advisory () https://github.com/7rah/oss-cve/blob/6adb836d24ca446fd168c3acdc4c170beb77fe0f/roocode-glob-token.md - Exploit, Mitigation, Third Party Advisory

15 Oct 2026, 19:03

Type Values Removed Values Added
CPE cpe:2.3:a:roocode:roo_code:*:*:*:*:*:*:*:*
First Time Roocode
Roocode roo Code
References () https://github.com/7rah/oss-cve/blob/6adb836d24ca446fd168c3acdc4c170beb77fe0f/roocode-glob-token.md - () https://github.com/7rah/oss-cve/blob/6adb836d24ca446fd168c3acdc4c170beb77fe0f/roocode-glob-token.md - Exploit, Mitigation, Third Party Advisory
References () https://github.com/RooCodeInc/Roo-Code/blob/v3.54.0/src/shared/parse-command.ts#L148-L172 - () https://github.com/RooCodeInc/Roo-Code/blob/v3.54.0/src/shared/parse-command.ts#L148-L172 - Product
References () https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-glob-token-discarding-command-substitution - () https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-glob-token-discarding-command-substitution - Third Party Advisory

13 Oct 2026, 19:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-13 19:18

Updated : 2026-10-26 20:17

NVD link : CVE-2026-110205

Mitre link : CVE-2026-110205

CVE.ORG link : CVE-2026-110205

JSON object : View

Products Affected

roocode

  • roo_code
CWE
CWE-184

Incomplete List of Disallowed Inputs