Roo Code up to version 3.54.0 contains a command injection flaw in its auto‑approve execute feature. The parser replaces parameter expansions with placeholders before extracting command substitutions, causing the containsDangerousSubstitution guard to miss nested payloads. The outer command, which is allowed by an allowlist, is then executed through execa, permitting an attacker to run arbitrary shell commands on the host running Roo Code. The weakness is a command injection (CWE‑184).

All installations of RooCodeInc’s Roo‑Code product at or below version 3.54.0 are affected, provided the auto‑approve execute feature is enabled. The vulnerability exists in the command parser and execa wrapper included in the Roo‑Code codebase.

The CVSS base score of 7.7 signals a high‑impact vulnerability. The EPSS score of 2% indicates a modest but non‑zero likelihood of exploitation, and the flaw is not catalogued in CISA’s KEV. Based on the description, it is inferred that an attacker needs the ability to provide input to the vulnerable auto‑approve execute feature, which may require authenticated or privileged access depending on the deployment. The injection can occur when that input reaches the parser, allowing the attacker to execute arbitrary commands on the host.