Roo Code

Roo Code through 3.54.0 contains a command approval bypass in getCommandDecision() allowing attackers to execute denied shell commands by prefixing them with a redirection operator.

A command injection vulnerability in Roo Code versions through 3.54.0 allows attackers to bypass allowlist/denylist enforcement in the auto-approve execute feature. By nesting command substitutions inside parameter expansion defaults, the command parser in parse-command.ts fails to detect the dangerous payloads, leading to their auto-approval and subsequent arbitrary command execution via the shell through execa.