CVE-2026-82537: Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word immediately followed by a hash character, separator, and denied command to pass the approval gate while bash executes the denied command with the agent's auto-execute privileges on the developer's machine.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Developers using Roo-Code through 3.54.0 with auto-execute privileges are exposed when they are induced to process a crafted command string. The attack executes commands on the developer's machine with the agent's auto-execute privileges.
What does an attacker need to exploit the vulnerability?
An attacker needs to provide a crafted command string that places an allowlisted word immediately before a hash character, a separator, and a command that would normally be denied. User interaction is required, as reflected by the UI:R vector.
Are default installations affected?
The provided information identifies the auto-approve or auto-execute behavior as the affected condition, but does not state whether it is enabled by default. Environments where Roo-Code can automatically execute approved shell commands should be treated as affected through version 3.54.0.
What can be done before a patch is available or deployed?
Disable or restrict auto-approve and auto-execute privileges for shell commands, and require manual review of command strings before execution. Pay particular attention to commands containing hash characters and shell separators after allowlisted words.