RO
Vendor
Roocode
16
CVEs
0
On KEV
5
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110206 | RC Roo Code Roocode | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position |
| CVE-2026-110205 | RC Roo Code Roocode | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution |
| CVE-2026-110204 | RC Roo Code Roocode | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution |
| CVE-2026-110203 | RC Roo Code Roocode | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization |
| CVE-2026-110202 | RC Roo Code Roocode | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping |
| CVE-2026-30307 | RC Roo Code Roocode | 9.8 | Mar 30 | Roo Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective |
| CVE-2025-65946 | RC Roo Code Roocode | 8.1 | Nov 21 | Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug |
| CVE-2025-58374 | RC Roo Code Roocode | 7.8 | Sep 6 | Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts |
| CVE-2025-58373 | RC Roo Code Roocode | 6.5 | Sep 5 | Roo Code: Symlink-bypass of .rooignore can lead to unintended file disclosure |
| CVE-2025-58372 | RC Roo Code Roocode | 9.8 | Sep 5 | Roo Code: Potential Remote Code Execution via .code-workspace |
| CVE-2025-58371 | RC Roo Code Roocode | 9.8 | Sep 5 | Roo Code is vulnerable to command injection via GitHub actions workflow |
| CVE-2025-58370 | RC Roo Code Roocode | 8.1 | Sep 5 | Roo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect Reference |
| CVE-2025-54377 | RC Roo Code Roocode | 7.8 | Jul 23 | Roo Code Lacks Line Break Validation in its Command Execution Tool |
| CVE-2025-53536 | RC Roo Code Roocode | 8.1 | Jul 7 | Roo Code allows Potential Remote Code Execution via .vscode/settings.json |
| CVE-2025-53098 | RC Roo Code Roocode | 8.1 | Jun 27 | Roo Code Vulnerable to Potential Remote Code Execution via Model Context Protocol |
| CVE-2025-53097 | RC Roo Code Roocode | 7.5 | Jun 27 | Roo Code extension vulnerable to Potential Information Leakage via JSON Schema |