Attack Chain

1. An attacker identifies a Roo Code application instance that utilizes the "auto-approve execute" feature, which processes user-supplied command parameters.
2. The attacker crafts a malicious input string, embedding command substitutions (e.g., $(), `) within shell parameter expansion defaults (e.g., ${VAR:-...}, ${VAR/.../} ).
3. This crafted input targets a command prefix or structure that is typically allowlisted or implicitly trusted by the "auto-approve execute" feature.
4. The vulnerable parse-command.ts component processes the attacker's input, mistakenly replacing the benign-looking outer parameter expansion components with opaque placeholders.
5. Due to this parsing order, the containsDangerousSubstitution guard fails to detect the truly malicious nested command substitutions, leading to the payload being auto-approved for execution.
6. The execa utility, which is responsible for executing shell commands, receives and processes the auto-approved, malicious command string.
7. The attacker's arbitrary commands are executed on the underlying operating system with the privileges of the Roo Code application, potentially leading to full system compromise, data exfiltration, or other severe impacts.

Impact

Successful exploitation of CVE-2026-63108 results in arbitrary command execution on the server hosting the Roo Code application. This could allow attackers to execute any command, bypass security controls, steal sensitive data, install backdoors, or disrupt services. The high CVSS v3.1 Base Score of 8.8 reflects the critical nature of this vulnerability, indicating a significant risk to the confidentiality, integrity, and availability of affected systems. Organizations using vulnerable Roo Code versions are at risk of complete system compromise if an attacker can leverage this flaw.

Recommendation

• Patch CVE-2026-63108 by upgrading Roo Code to a version beyond 3.54.0 immediately.
• Deploy the Sigma rule "Detect CVE-2026-63108 Exploitation Attempt - Roo Code Command Injection" to your SIEM and investigate any generated alerts for signs of compromise.
• Monitor webserver logs for patterns indicative of shell metacharacters and command substitution attempts within URL parameters or POST bodies, especially for applications using the "auto-approve execute" feature.