Description
A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a manipulation can lead to code injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-08-27
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Code Injection
Action: Discontinue Use
AI Analysis

Impact

The vulnerability exists in the ExecaTerminalProcess function of the README File Handler component in RooCodeInc Roo-Code. It allows an attacker to inject arbitrary code via crafted input, leading to remote execution of commands and potentially full compromise of the system. The flaw illustrates a command injection weakness (CWE‑74) that also involves unsafe code evaluation (CWE‑94).

Affected Systems

RooCodeInc Roo-Code, all releases up to and including version 3.51.1. These releases are no longer supported by the maintainer and the repository has been archived, meaning no further updates or fixes are available.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS data is missing, and the issue is not listed in the CISA KEV catalog. The issue can be triggered remotely through the web interface that exposes the README file handler, and a publicly available exploit demonstrates the feasibility of exploitation The lack of official fixes, combined with the product’s unsupported status, increases the overall risk for environments that continue to run legacy versions.

Generated by OpenCVE AI on August 28, 2026 at 08:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Discontinue use of RooCodeInc Roo-Code or migrate to a maintained alternative that does not expose the vulnerable function.
  • If removal is not possible, isolate the application behind a firewall and restrict all inbound traffic to the README file handler endpoint so that only trusted internal users can access it.
  • Validate any data passed to the README file handler and ensure that no direct system calls or eval‑style execution are performed with user‑supplied content. When code must be executed, use a safe, sandboxed environment that enforces strict input sanitization.

Generated by OpenCVE AI on August 28, 2026 at 08:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Roocode
Roocode roo-code
Vendors & Products Roocode
Roocode roo-code

Fri, 28 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a manipulation can lead to code injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer.
Title RooCodeInc Roo-Code README File ExecaTerminalProcess code injection
First Time appeared Roocodeinc
Roocodeinc roo-code
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:roocodeinc:roo-code:*:*:*:*:*:*:*:*
Vendors & Products Roocodeinc
Roocodeinc roo-code
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Roocode Roo-code
Roocodeinc Roo-code
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-28T15:32:38.871Z

Reserved: 2026-08-27T14:49:20.043Z

Link: CVE-2026-81834

cve-icon Vulnrichment

Updated: 2026-08-28T15:32:12.282Z

cve-icon NVD

Status : Deferred

Published: 2026-08-27T20:18:56.720

Modified: 2026-08-28T20:20:13.230

Link: CVE-2026-81834

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T14:22:25Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')