CVE-2026-110205: Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to or ? glob characters. Attackers using indirect prompt injection can craft commands like echo $(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Roo Code installations through version 3.54.0 are exposed when auto-approval is enabled. Exploitation is described in the context of an attacker delivering an indirect prompt injection.
What conditions are needed for exploitation?
The attacker needs to cause Roo Code to process a crafted command containing command substitution adjacent to a * or ? glob character, such as echo *$(...). The crafted command must match an allowlisted prefix so that it is auto-approved despite containing a command that would otherwise be denied.
Does this affect configurations without auto-approval enabled?
The described approval bypass occurs when auto-approval is enabled. The provided information does not state that commands execute without user approval when auto-approval is disabled.
What can be done while patching is not available?
Disable auto-approval or avoid allowlisting command prefixes that could be matched by crafted commands containing glob characters and command substitution. This prevents the described path from executing denied commands without user approval.