Roo‑Code versions prior to 3.54.0 perform command approval through parseCommandLine() but discard command substitutions that appear adjacent to glob characters such as * or ?. This allows an attacker to craft input like echo *$(…); the glob token causes the command substitution to be stripped from the approval check while the resulting command still begins with an allowlisted prefix, thereby winning auto‑approval. The attacker can then execute arbitrary shell commands without user consent, resulting in full command execution on the underlying system. This weakness is an example of Command Injection via improper handling of glob tokens (CWE‑184).

The vulnerability is present in all versions of Roo‑Code released by RooCodeInc through 3.54.0, inclusive. Any deployment of Roo‑Code 3.54.0 or older is affected, regardless of operating system or host configuration.

The CVSS score of 7.7 indicates a high severity. Exploitation requires the target to have auto‑approval enabled for command execution, and an attacker must be able to supply an indirect prompt that contains a glob token followed by a nested command substitution. The EPSS score of < 1% indicates a very low but non‑zero probability, and the vulnerability is not listed in CISA KEV, implying no known public exploits yet. While the attack vector is clear, these factors suggest that the likelihood of exploitation in the wild remains uncertain. Nonetheless, the impact of successful exploitation would be full system compromise via arbitrary command execution.