CVE-2025-58370: Roo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect Reference
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent was configured to auto-approve execution of certain commands, an attacker able to influence prompts could abuse this weakness to execute additional arbitrary commands alongside the intended one. This is fixed in version 3.26.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58370?
CVE-2025-58370 has been assigned a high severity rating due to its potential to allow unauthorized command execution.
How do I fix CVE-2025-58370?
To fix CVE-2025-58370, update Roo Code to version 3.26.0 or later to address the vulnerability in command parsing logic.
What versions of Roo Code are affected by CVE-2025-58370?
Roo Code versions below 3.26.0 are affected by CVE-2025-58370.
What are the consequences of CVE-2025-58370?
The consequences of CVE-2025-58370 include potential unauthorized command execution leading to a compromise of the user's environment.
Is it safe to use versions of Roo Code below 3.26.0 after CVE-2025-58370?
Using versions of Roo Code below 3.26.0 after CVE-2025-58370 is not safe as they contain a known vulnerability.