CVE-2026-110203: Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine(). Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separators behind allowlisted prefixes like echo, executing commands without user approval.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack is network-reachable, requires no attacker privileges, and has low attack complexity according to the supplied vector. It does require user interaction and relies on indirect prompt injection to introduce crafted command text.
Which environments are most exposed?
Environments where Roo Code processes attacker-influenced content that can carry indirect prompt injection are exposed to this technique. The crafted input uses escaped or single-quoted double quotes to conceal command separators behind an allowlisted prefix such as echo.
What is the security impact if exploitation succeeds?
An attacker can cause denied shell commands to be auto-approved and executed without user approval. The reported impact includes high confidentiality, integrity, and availability impact.