Description
A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/helpers.ts of the component CodeIndexManager. Performing a manipulation results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-08-27
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Injection
Action: Patch
AI Analysis

Impact

The vulnerability lies in the optimizeQuery function within the CodeIndexManager component of RooCodeInc Roo‑Code. By manipulating input to this helper, an attacker can inject arbitrary code through the query handling logic, enabling the execution of malicious code on the system. This flaw is classified as both CWE‑74 (Improper Handling of Special Characters) and CWE‑94 (Improper Control of Generation of Code).

Affected Systems

Affected versions include Roo‑Code releases up to 3.51.1, which are no longer supported or maintained by the vendor.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity classification. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but a public exploit has been released and remote exploitation is possible. The likely attack vector involves an attacker sending a crafted request to the optimizeQuery endpoint, causing injected code to execute on the host. Because the product is archived and unsupported, effective remediation may be limited to migration or removal of the vulnerable component, increasing the overall risk for current users.

Generated by OpenCVE AI on August 28, 2026 at 08:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official patch or update Roo‑Code to a supported release that resolves the injection flaw, if such an update is available.
  • If no newer supported version can be installed, remove or disable the CodeIndexManager component and its optimizeQuery function from the application.
  • Implement strict input validation around the query parameters that are forwarded to optimizeQuery, ensuring that special characters are escaped or sanitized to mitigate CWE‑74 and CWE‑94.

Generated by OpenCVE AI on August 28, 2026 at 08:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Roocode
Roocode roo-code
Vendors & Products Roocode
Roocode roo-code

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/helpers.ts of the component CodeIndexManager. Performing a manipulation results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer.
Title RooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection
First Time appeared Roocodeinc
Roocodeinc roo-code
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:roocodeinc:roo-code:*:*:*:*:*:*:*:*
Vendors & Products Roocodeinc
Roocodeinc roo-code
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Roocode Roo-code
Roocodeinc Roo-code
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T22:05:04.284Z

Reserved: 2026-08-27T14:49:14.322Z

Link: CVE-2026-81833

cve-icon Vulnrichment

Updated: 2026-08-31T21:50:38.463Z

cve-icon NVD

Status : Deferred

Published: 2026-08-27T20:18:56.520

Modified: 2026-08-31T22:17:20.897

Link: CVE-2026-81833

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T08:45:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')