CVE-2026-63108

Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter expansions with opaque placeholders before extracting command substitutions, causing the containsDangerousSubstitution guard to miss nested payloads, which are then auto-approved based on the outer allowlisted command prefix and executed by the shell via execa, enabling arbitrary command execution.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/geo-chen/oss/blob/main/Roo-Code.md
https://www.vulncheck.com/advisories/roo-code-command-injection-via-parameter-expansion-parsing

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Roo Code hasta la versión 3.54.0 contiene una vulnerabilidad de inyección de comandos en la función de ejecución de aprobación automática que permite a los atacantes eludir la aplicación de listas de permitidos/denegados anidando sustituciones de comandos dentro de los valores predeterminados de expansión de parámetros. El analizador de comandos en parse-command.ts reemplaza las expansiones de parámetros con marcadores de posición opacos antes de extraer las sustituciones de comandos, lo que hace que el mecanismo de protección containsDangerousSubstitution pase por alto las cargas útiles anidadas, las cuales son luego aprobadas automáticamente basándose en el prefijo de comando externo en la lista de permitidos y ejecutadas por el shell a través de execa, lo que permite la ejecución arbitraria de comandos.

Information

Published : 2026-07-20 19:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-63108

Mitre link : CVE-2026-63108

CVE.ORG link : CVE-2026-63108

JSON object : View

Products Affected

No product.

CWE

CWE-184

Incomplete List of Disallowed Inputs

{"id": "CVE-2026-63108", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "disclosure@vulncheck.com"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63108", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-20T21:42:38.177300Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/RooCodeInc/Roo-Code", "vendor": "RooCodeInc", "product": "Roo-Code", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.54.0"}], "packageURL": "pkg:github/RooCodeInc/Roo-Code", "defaultStatus": "affected"}]}], "published": "2026-07-20T19:17:29.057", "references": [{"url": "https://github.com/geo-chen/oss/blob/main/Roo-Code.md", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/roo-code-command-injection-via-parameter-expansion-parsing", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-184"}]}], "descriptions": [{"lang": "en", "value": "Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter expansions with opaque placeholders before extracting command substitutions, causing the containsDangerousSubstitution guard to miss nested payloads, which are then auto-approved based on the outer allowlisted command prefix and executed by the shell via execa, enabling arbitrary command execution."}, {"lang": "es", "value": "Roo Code hasta la versi\u00f3n 3.54.0 contiene una vulnerabilidad de inyecci\u00f3n de comandos en la funci\u00f3n de ejecuci\u00f3n de aprobaci\u00f3n autom\u00e1tica que permite a los atacantes eludir la aplicaci\u00f3n de listas de permitidos/denegados anidando sustituciones de comandos dentro de los valores predeterminados de expansi\u00f3n de par\u00e1metros. El analizador de comandos en parse-command.ts reemplaza las expansiones de par\u00e1metros con marcadores de posici\u00f3n opacos antes de extraer las sustituciones de comandos, lo que hace que el mecanismo de protecci\u00f3n containsDangerousSubstitution pase por alto las cargas \u00fatiles anidadas, las cuales son luego aprobadas autom\u00e1ticamente bas\u00e1ndose en el prefijo de comando externo en la lista de permitidos y ejecutadas por el shell a trav\u00e9s de execa, lo que permite la ejecuci\u00f3n arbitraria de comandos."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "disclosure@vulncheck.com"}