High severity · published Nov 21, 2025
CVE-2025-65946
Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug
8.1
CVSS
0.7%
EPSS
No
On KEV
Description
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list prefixes. This issue has been patched in version 3.26.7.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RO
Roo-Code · RooCodeInc
< 3.26.7 · source: vendor
RC
Roo Code · Roocode
before 3.26.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-65946
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-65946
Patch
https://github.com/RooCodeInc/Roo-Code/commit/b50104cc5987ce64f5154309d967ae8c74cfd1f3
Issue Tracking
https://github.com/RooCodeInc/Roo-Code/pull/7667
Vendor Advisory
https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-hwm7-w97p-4h8p
More from Roo-Code
9.8
CVE-2025-58372
Roo Code: Potential Remote Code Execution via .code-workspace
9.8
CVE-2025-58371
Roo Code is vulnerable to command injection via GitHub actions workflow
8.8
CVE-2026-110206
Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position
8.8
CVE-2026-110205
Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution
8.8
CVE-2026-110204
Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution