{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/roo-code/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-63108"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Roo Code (through 3.54.0)"],"_cs_severities":["high"],"_cs_tags":["command-injection","rce","web-vulnerability","cve"],"_cs_type":"advisory","_cs_vendors":["Roo Code"],"content_html":"\u003cp\u003eA critical command injection vulnerability, identified as CVE-2026-63108, affects Roo Code versions up to and including 3.54.0. This flaw resides within the \u0026quot;auto-approve execute\u0026quot; feature, which is designed to enforce allowlist or denylist policies for executed commands. Attackers can bypass these security measures by carefully crafting malicious inputs that embed command substitutions within parameter expansion defaults. The underlying command parser, specifically in \u003ccode\u003eparse-command.ts\u003c/code\u003e, fails to correctly identify these nested dangerous payloads. It replaces outer parameter expansions with safe placeholders before scrutinizing for command substitutions, thereby circumventing the \u003ccode\u003econtainsDangerousSubstitution\u003c/code\u003e guard. Consequently, the attacker's commands are mistakenly auto-approved and then executed by the system's \u003ccode\u003eexeca\u003c/code\u003e utility via the shell, leading to arbitrary command execution on the server. This vulnerability poses a severe risk of remote code execution.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a Roo Code application instance that utilizes the \u0026quot;auto-approve execute\u0026quot; feature, which processes user-supplied command parameters.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious input string, embedding command substitutions (e.g., \u003ccode\u003e$()\u003c/code\u003e, \u003ccode\u003e`\u003c/code\u003e) within shell parameter expansion defaults (e.g., \u003ccode\u003e${VAR:-...}\u003c/code\u003e, \u003ccode\u003e${VAR/.../}\u003c/code\u003e ).\u003c/li\u003e\n\u003cli\u003eThis crafted input targets a command prefix or structure that is typically allowlisted or implicitly trusted by the \u0026quot;auto-approve execute\u0026quot; feature.\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003eparse-command.ts\u003c/code\u003e component processes the attacker's input, mistakenly replacing the benign-looking outer parameter expansion components with opaque placeholders.\u003c/li\u003e\n\u003cli\u003eDue to this parsing order, the \u003ccode\u003econtainsDangerousSubstitution\u003c/code\u003e guard fails to detect the truly malicious nested command substitutions, leading to the payload being auto-approved for execution.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eexeca\u003c/code\u003e utility, which is responsible for executing shell commands, receives and processes the auto-approved, malicious command string.\u003c/li\u003e\n\u003cli\u003eThe attacker's arbitrary commands are executed on the underlying operating system with the privileges of the Roo Code application, potentially leading to full system compromise, data exfiltration, or other severe impacts.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-63108 results in arbitrary command execution on the server hosting the Roo Code application. This could allow attackers to execute any command, bypass security controls, steal sensitive data, install backdoors, or disrupt services. The high CVSS v3.1 Base Score of 8.8 reflects the critical nature of this vulnerability, indicating a significant risk to the confidentiality, integrity, and availability of affected systems. Organizations using vulnerable Roo Code versions are at risk of complete system compromise if an attacker can leverage this flaw.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-63108 by upgrading Roo Code to a version beyond 3.54.0 immediately.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect CVE-2026-63108 Exploitation Attempt - Roo Code Command Injection\u0026quot; to your SIEM and investigate any generated alerts for signs of compromise.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003ewebserver\u003c/code\u003e logs for patterns indicative of shell metacharacters and command substitution attempts within URL parameters or POST bodies, especially for applications using the \u0026quot;auto-approve execute\u0026quot; feature.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T19:22:42Z","date_published":"2026-07-20T19:22:42Z","id":"https://feed.craftedsignal.io/briefs/2026-07-roo-code-command-injection/","summary":"A command injection vulnerability in Roo Code versions through 3.54.0 allows attackers to bypass allowlist/denylist enforcement in the auto-approve execute feature. By nesting command substitutions inside parameter expansion defaults, the command parser in parse-command.ts fails to detect the dangerous payloads, leading to their auto-approval and subsequent arbitrary command execution via the shell through execa.","title":"Roo Code Command Injection Vulnerability (CVE-2026-63108)","url":"https://feed.craftedsignal.io/briefs/2026-07-roo-code-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Roo Code","version":"https://jsonfeed.org/version/1.1"}