High severity · published Sep 5, 2025
CVE-2025-58370
Roo Code is an AI-powered autonomous coding agent that lives in users' editors
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent was configured to auto-approve execution of certain commands, an attacker able to influence prompts could abuse this weakness to execute additional arbitrary commands alongside the intended one. This is fixed in version 3.26.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RC
Roo Code · Roocode
before 3.26.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-58370
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-58370
Vendor Advisory
https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-2rm5-cvcm-7592
More from Roo Code
9.8
CVE-2026-30307
Roo Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective
9.8
CVE-2025-58372
Roo Code is an AI-powered autonomous coding agent that lives in users' editors
9.8
CVE-2025-58371
Roo Code is an AI-powered autonomous coding agent that lives in users' editors
8.8
CVE-2026-110206
Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position
8.8
CVE-2026-110205
Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution