The vulnerability arises in Roo-Code’s command parsing logic, where a command approval bypass allows an attacker to embed a command substitution directly in the command position. The shell executes the substituted output without prompting the user, enabling arbitrary shell commands to run at the system level. This flaw can lead to full compromise of the host running the application.

All versions of Roo-Code from RooCodeInc up to and including 3.54.0 are susceptible to this bypass. No further version granularity is listed in the advisory.

The CVSS score of 7.7 indicates moderate to high severity. The EPSS score is currently unavailable, and the flaw is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. However, because the flaw is exercised via user-supplied command input, an attacker who gains the ability to submit commands—such as through an interface that accepts command strings—can trigger the bypass. The attack requires only the ability to inject a carefully crafted command substitution; no additional privileges are needed beyond the context in which the command is executed.