Roo-Code versions up to and including 3.54.0 allow an attacker to bypass the auto‑approve gate by exploiting a mismatch in word‑boundary detection between the shell parser used by the approval gate and the bash interpreter. Attackers can craft a comment in a pull request that contains an allowed word immediately followed by a hash character or separator and a denied command; the approval gate accepts the comment, while bash executes the denied command with the agent’s auto‑execute privileges on the developer’s machine. The result is the execution of arbitrary shell commands with elevated privileges on the code‑review environment, representing a complete compromise of the affected system. The weakness is classified as CWE‑436, a mismatch in input filtering leading to unintended code execution.

The vulnerability affects RooCodeInc’s Roo‑Code product through version 3.54.0 inclusive. No later versions are identified as affected in the provided data.

The CVSS score of 7.7 indicates a high severity vulnerability. No EPSS value is available, so the exploitation probability is uncertain, and the issue is not presently listed in the CISA KEV catalog. The likely attack vector is the developer’s local environment during code review; an actor must inject the crafted comment into the repository, causing the auto‑approve process to trigger the malicious command. Given the elevated privileges granted to the agent, the exploit can lead to full system compromise. The lack of a widely distributed exploit and the dependence on a code‑review workflow reduce the immediacy of risk, but the high severity and local privilege escalation still demand prompt attention.