Roo Code: five ways to slip denied commands past auto-approve (CVE-2026-110202 to 110206), no fix coming
Roo Code through 3.54.0 has five command-approval bypasses. With auto-approve on, a prompt injection can get a denied shell command run on your machine by hiding it behind an allowlisted command like echo. The project was archived in May 2026, so no patch is expected.
What it is
NVD lists five CVEs, all “Roo Code through 3.54.0”: a bare >& redirect prefix (CVE-2026-110202), quote-masking in parseCommandLine() (CVE-2026-110203), ${ command; } substitutions on bash 5.3+ or ksh93 (CVE-2026-110204), command substitution next to * or ? globs (CVE-2026-110205), and a command substitution in command position such as $(echo touch /tmp/x) (CVE-2026-110206).
Each one needs indirect prompt injection (instructions hidden in a file, web page or issue the agent reads) and auto-approval of commands to be enabled.
The researcher’s write-up notes the RooCodeInc/Roo-Code repository was archived on 16 May 2026; v3.54.0 (15 May 2026) is the last release.
How to check
- Check whether you still run the Roo Code extension in VS Code, and whether “always approve execute” or any command allowlist is turned on.
How to fix
- Turn off auto-approval for terminal commands and approve each command by hand.
- Since the project is archived and no fixed version exists, plan a move to a maintained coding agent.