VYPR
← All advisories
High severity8.1NVD Advisory· Published Sep 5, 2025· Updated Jun 17, 2026

CVE-2025-58370

CVE-2025-58370

Description

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent was configured to auto-approve execution of certain commands, an attacker able to influence prompts could abuse this weakness to execute additional arbitrary commands alongside the intended one. This is fixed in version 3.26.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • RooCodeInc/Roo Code3 versions
    cpe:2.3:a:roocode:roo_code:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:roocode:roo_code:*:*:*:*:*:*:*:*range: <3.26.0
    • (no CPE)range: <3.26.0
    • (no CPE)range: < 3.26.0
  • Roo Code/RooCodellm-fuzzy
    Range: <3.26.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.