Description
A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been published and may be used. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-08-27
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Path Traversal enabling remote exploitation
Action: Discontinue Use
AI Analysis

Impact

The vulnerability is a path traversal flaw located in the path.resolve function within src/core/tools/ApplyPatchTool.ts of the ApplyPatchTool component. A specially crafted input can cause the tool to resolve a path that escapes the intended directory boundary, potentially allowing an attacker to read or write arbitrary files on the host system where the tool runs. The CVSS score of 5.3 indicates a moderate severity, and the issue is classified as CWE-22.

Affected Systems

The flaw affects RooCodeInc’s Roo-Code product through version 3.51.1, which is no longer supported and has been archived by the vendor.

Risk and Exploitability

The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, implying a relatively low to moderate probability of exploitation. Nonetheless, an exploit has been published and can be triggered remotely, likely through a service that invokes the vulnerable ApplyPatchTool. The attack does not require local privilege, making it actionable over the network to any installation exposing this tool.

Generated by OpenCVE AI on August 28, 2026 at 09:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Disable or remove the ApplyPatchTool component so it cannot be invoked remotely
  • Replace Roo-Code with a maintained and supported alternative that does not expose path resolution code
  • If removal is not immediately possible, modify the ApplyPatchTool source to sanitize input paths—reject traversal sequences and constrain file operations to a trusted directory surface
  • Restrict the file system permissions for the user process executing ApplyPatchTool to limit access to critical directories

Generated by OpenCVE AI on August 28, 2026 at 09:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
First Time appeared Roocode
Roocode roo-code
Vendors & Products Roocode
Roocode roo-code

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been published and may be used. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer.
Title RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal
First Time appeared Roocodeinc
Roocodeinc roo-code
Weaknesses CWE-22
CPEs cpe:2.3:a:roocodeinc:roo-code:*:*:*:*:*:*:*:*
Vendors & Products Roocodeinc
Roocodeinc roo-code
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Roocode Roo-code
Roocodeinc Roo-code
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-28T15:32:48.327Z

Reserved: 2026-08-27T14:49:33.143Z

Link: CVE-2026-81837

cve-icon Vulnrichment

Updated: 2026-08-28T15:32:44.429Z

cve-icon NVD

Status : Deferred

Published: 2026-08-28T00:18:21.963

Modified: 2026-08-28T20:20:13.507

Link: CVE-2026-81837

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T09:15:05Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')