CVE-2026-110206: Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $(echo touch /tmp/x) that pass the echo allowlist check, causing the shell to execute the output without user approval.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Roo Code installations through version 3.54.0 are affected when they process attacker-controlled instructions that can induce the tool to submit a shell command. The described delivery path is indirect prompt injection.
What does an attacker need to exploit it?
An attacker needs to cause Roo Code to process a command containing command substitution in command position, such as $(echo touch /tmp/x). No prior privileges are required, but user interaction is required according to the CVSS vector.
Why does the command receive auto-approval?
The vulnerable parseCommandLine() logic allows the command to pass an echo allowlist check even though the shell later executes the command substitution output as a command. This bypasses the expected user approval for the resulting shell command.