Command Approval Bypass in Roo Code via Redirection

hello@craftedsignal.io — Wed, 14 Oct 2026 04:36:32 +0000

Roo Code versions 3.54.0 and earlier contain a command approval bypass vulnerability in the getCommandDecision() function. This vulnerability allows an attacker to execute denied shell commands on a developer's machine by utilizing a redirection operator (>&) as a prefix. The flaw stems from an insufficient validation mechanism in the allowlist logic, where an attacker can craft a payload via indirect prompt injection. By prefixing a malicious command with a redirection operator, the application incorrectly matches the input against an allowlist for a benign command (such as 'echo'), while the underlying shell proceeds to execute the intended malicious instructions. This poses a significant risk to developers using the extension in environments with sensitive access.

Roo Code (<= 3.54.0) - CraftedSignal Threat Feed

Command Approval Bypass in Roo Code via Redirection