CVE-2025-58370CWE-78

Roo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect Reference

High · published September 5, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent was configured to auto-approve execution of certain commands, an attacker able to influence prompts could abuse this weakness to execute additional arbitrary commands alongside the intended one. This is fixed in version 3.26.0.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00437 · 36.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-09-05T22:09Z
EPSS history
Timeline
  • 05 SEP 22:09Z
    Roo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect Reference
    cvelistv5