CVE-2026-110204: Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to this bypass?
Roo Code installations through version 3.54.0 are exposed when commands are executed through bash 5.3 or later, or ksh93. The described attack uses an allowlisted command containing a ${ command; } substitution.
Does exploitation require prior access or explicit approval of the denied command?
No privileges are required according to the supplied vector, but user interaction is required. An attacker can use indirect prompt injection to place a denied command inside an otherwise allowlisted command such as echo, causing it to run without approval.