CVE-2025-58371

🚨 A single malicious pull request could grant an attacker full control over your repository! In versions 3.26.6 and below of Roo Code, an unsanitized GitHub workflow opens the door to Remote Code Execution (RCE). 🔥 Think of your repository as a high-security vault, and this vulnerability as a sneaky insider who can bypass security checks by crafting a forged badge. Once inside, they can not only access sensitive secrets but also manipulate anything they want! If exploited, an attacker could execute arbitrary commands on the Actions runner, push or modify code in the repository, and even create malicious releases or packages. This could lead to a catastrophic compromise of your repository and all its connected services, leaving your valuable code at the mercy of an adversary!

If exploited, an attacker could execute arbitrary commands on the Actions runner, push or modify code in the repository, and even create malicious releases or packages. This could lead to a catastrophic compromise of your repository and all its connected services, leaving your valuable code at the mercy of an adversary! Update to version 3.26.7 immediately to patch this vulnerability. Review your workflows to ensure they sanitize all inputs properly, and consider implementing additional security measures like least privilege access. Don't forget to audit your repository for any unauthorized changes! You've got this! Fixing this vulnerability will keep your repository secure and your code safe. 🛡️