CVE-2026-82536: Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line with an allowlisted prefix followed by the stderr-redirecting pipe operator and a denied command, causing the parser to approve the full pipeline while bash executes the denied component with the agent's auto-execute privileges on the developer's machine.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roo-Codeto a version that resolves this vulnerability.Fixed in 3.54.0 - Compensating control
Mitigate the auto-approve bypass by preventing use of the bash pipe operator in shell command input that Roo-Code parses/auto-approves, so pipelines with stderr-redirecting and denied commands cannot be executed with the agent’s auto-execute privileges.
Event History
Frequently Asked Questions
Which environments are exposed?
Roo-Code versions through 3.54.0 are affected when shell-command auto-approval can grant the agent auto-execute privileges on a developer's machine.
Does exploitation require attacker privileges or user interaction?
The CVSS vector indicates no attacker privileges are required and that user interaction is required. The attack is network-based and has low attack complexity.
What command construction enables the bypass?
An attacker can place an allowlisted command prefix before the stderr-redirecting bash pipe operator, followed by a command that should be denied. The parser approves the pipeline while bash executes the denied component with the agent's auto-execute privileges.