The vulnerability is an operating‑system command injection flaw located in Roo Code’s command auto‑approval module. It arises from weak regular‑expression checks that fail to block shell command substitutions such as $(...) and backticks. An attacker can embed these constructs in otherwise legitimate commands—for example, git log --grep="$(malicious_command)"—and the module will incorrectly classify the input as safe. The resulting automatic approval triggers execution of the injected code, giving the attacker full remote code execution with the privileges of the running process.

All deployments of the Roo Code command auto‑approval module are impacted. No specific product versions are listed, indicating that the flaw exists across the current release until a vendor patch is released.

The CVSS score of 9.8 signals extremely high severity, and the EPSS score of less than 1% indicates that the vulnerability is not yet widely exploited but could be abused quietly. It is not catalogued in CISA’s KEV list. Although the direct attack vector is not described, the nature of the flaw suggests that exploitation can occur via any interface that accepts user‑supplied shell commands, whether through the web UI or an API. Once a crafted command is submitted, no further user interaction is required for the malicious code to run.