Roo-Code versions up to 3.54.0 contain a command approval bypass in the getCommandDecision routine. The flaw lets attackers prepend a bare >& redirect to any denied shell command, enabling the system to treat the stripped command as approved. When an attacker crafts such an input through indirect prompt injection, the redirect is removed before approval, yet the original command executes on the developer machine, potentially exposing the environment to arbitrary command execution.

RooCodeInc's Roo-Code, affecting all releases through version 3.54.0. No subsequent releases are listed as affected.

The CVSS score of 7.7 indicates a high severity level. No EPSS score is available, and the vulnerability is not yet in the CISA KEV catalog. The attack vector is inferred to be remote code execution via an indirect prompt injection that supplies a shell command; the implementation flaw in the approval logic makes this possible once the input reaches the system. Even though the weakness is not widely exploited yet, the high CVSS and lack of mitigation mean that a successful exploit could compromise developer machines without additional privileges.