CVE-2026-110202: Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping
Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo while the shell runs the denied command on the developer machine.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Developers using Roo Code through version 3.54.0 are exposed when command auto-approval relies on the affected allowlist decision logic. The impact occurs on the developer machine where Roo Code executes shell commands.
What does an attacker need to exploit it?
An attacker needs a way to influence Roo Code into processing a malicious command, such as through indirect prompt injection. They can prefix a denied command with a bare >& redirect so the approval logic matches an allowed redirect target while the shell executes the denied command.
Is user interaction required?
Yes. The supplied severity vector indicates user interaction is required. The available data does not specify the exact action the user must take.
How can I tell whether my environment may be affected?
Check whether Roo Code is version 3.54.0 or earlier and whether its command auto-approval feature permits commands based on an allowlist. Review command-approval handling for commands beginning with a bare >& redirect, particularly where the redirect target is an allowlisted command such as echo.