Roo Code through 3.54.0: multiple CVEs bypass command auto-approval via prompt injection
In one sentence On October 13 several CVEs were published for Roo Code through version 3.54.0: shell syntax tricks make a denied command look allowlisted, and indirect prompt injection can get it executed on the developer machine without confirmation when auto-approval is on.
Roo Code is a coding agent that works inside VS Code and can run commands in the terminal. To avoid asking for confirmation at every step, users can enable auto-approval: commands that start a certain way (an allowlist) run on their own, others are blocked or need confirmation.
On October 13 several vulnerabilities were published that bypass exactly this filter. Roo Code's check interprets the command differently from how the shell actually runs it: by adding certain redirect symbols, wildcard characters or quotes, a denied command can look harmless to the filter and still execute.
The concrete risk comes from indirect prompt injection: instructions hidden in a file, a web page or a repository read by the agent can push it to launch a crafted command. Anyone using Roo Code with command auto-approval enabled should switch it off until a fixed version is available.
Companies
RooCodeInc
Tools
Roo Code
Tags
Sources