RO
Vendor
RooCodeInc
24
CVEs
0
On KEV
5
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110206 | RO Roo-Code RooCodeInc | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position |
| CVE-2026-110205 | RO Roo-Code RooCodeInc | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution |
| CVE-2026-110204 | RO Roo-Code RooCodeInc | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution |
| CVE-2026-110203 | RO Roo-Code RooCodeInc | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization |
| CVE-2026-110202 | RO Roo-Code RooCodeInc | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping |
| CVE-2026-82537 | RO Roo-Code RooCodeInc | 8.8 | Sep 8 | Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch |
| CVE-2026-82536 | RO Roo-Code RooCodeInc | 8.8 | Sep 8 | Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator |
| CVE-2026-81837 | RO Roo-Code RooCodeInc | 6.3 | Aug 27 | RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal |
| CVE-2026-81836 | RO Roo-Code RooCodeInc | 3.7 | Aug 27 | RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission |
| CVE-2026-81835 | RO Roo-Code RooCodeInc | 5.5 | Aug 27 | RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection |
| CVE-2026-81834 | RO Roo-Code RooCodeInc | 6.3 | Aug 27 | RooCodeInc Roo-Code README File ExecaTerminalProcess code injection |
| CVE-2026-81833 | RO Roo-Code RooCodeInc | 5.5 | Aug 27 | RooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection |
| CVE-2026-63108 | RO Roo-Code RooCodeInc | 8.8 | Jul 20 | Roo Code 3.54.0 Command Injection via Parameter Expansion Parsing |
| CVE-2025-65946 | RO Roo-Code RooCodeInc | 8.1 | Nov 21 | Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug |
| CVE-2025-58374 | RO Roo-Code RooCodeInc | 7.8 | Sep 6 | Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts |
| CVE-2025-58373 | RO Roo-Code RooCodeInc | 6.5 | Sep 5 | Roo Code: Symlink-bypass of .rooignore can lead to unintended file disclosure |
| CVE-2025-58372 | RO Roo-Code RooCodeInc | 9.8 | Sep 5 | Roo Code: Potential Remote Code Execution via .code-workspace |
| CVE-2025-58371 | RO Roo-Code RooCodeInc | 9.8 | Sep 5 | Roo Code is vulnerable to command injection via GitHub actions workflow |
| CVE-2025-58370 | RO Roo-Code RooCodeInc | 8.1 | Sep 5 | Roo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect Reference |
| CVE-2025-57771 | RO Roo-Code RooCodeInc | 8.1 | Aug 22 | Roo-Code potential remote code execution via auto-execute command parsing flaw |
| CVE-2025-54377 | RO Roo-Code RooCodeInc | 7.8 | Jul 23 | Roo Code Lacks Line Break Validation in its Command Execution Tool |
| CVE-2025-53536 | RO Roo-Code RooCodeInc | 8.1 | Jul 7 | Roo Code allows Potential Remote Code Execution via .vscode/settings.json |
| CVE-2025-53098 | RO Roo-Code RooCodeInc | 8.1 | Jun 27 | Roo Code Vulnerable to Potential Remote Code Execution via Model Context Protocol |
| CVE-2025-53097 | RO Roo-Code RooCodeInc | 7.5 | Jun 27 | Roo Code extension vulnerable to Potential Information Leakage via JSON Schema |