CVE-2025-54377: Roo Code Lacks Line Break Validation in its Command Execution Tool
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode does not validate line breaks (\n) in its command input, allowing potential bypass of the allow-list mechanism. The project appears to lack parsing or validation logic to prevent multi-line command injection. When commands are evaluated for execution, only the first line or token may be considered, enabling attackers to smuggle additional commands in subsequent lines. This is fixed in version 3.23.19.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54377?
CVE-2025-54377 has been classified as a medium severity vulnerability due to its potential to bypass the allow-list mechanism.
How do I fix CVE-2025-54377?
To fix CVE-2025-54377, upgrade Roo Code to version 3.23.19 or higher.
What are the risks of not addressing CVE-2025-54377?
Failing to address CVE-2025-54377 may allow unauthorized command execution through bypassing the input validation.
Which versions of Roo Code are affected by CVE-2025-54377?
Roo Code versions 3.23.18 and below are affected by CVE-2025-54377.
Is there a recommended mitigation for CVE-2025-54377?
The recommended mitigation for CVE-2025-54377 is to implement strict input validation until the software is updated.