Five flaws let Roo Code auto-approve banned shell commands

Five command approval bypass vulnerabilities in Roo Code, the AI coding agent made by Roo Code Inc, were published to the US National Vulnerability Database on 13 October 2026. All five affect Roo Code through version 3.54.0, and all five allow an attacker to run shell commands that the user has explicitly denied, without a confirmation prompt appearing.

The common thread is indirect prompt injection, where instructions hidden in content the agent reads, such as a file or web page, are treated as commands from the user. Roo Code offers an auto-approval feature that checks a proposed shell command against an allowlist of permitted prefixes and a denylist of forbidden ones. According to the NVD entries, the checks parse the command string differently from the way the shell itself interprets it. That gap is what the attacks exploit: the approval logic sees a harmless command such as echo, while the shell runs something else entirely.

The first issue, CVE-2026-110202, sits in a function called getCommandDecision(). The NVD record says a denied command can be auto-approved simply by prefixing it with a bare >& redirect. The allowlist matches the redirect target, for example echo, while the shell executes the denied command on the developer's machine.

The remaining four are in parseCommandLine(). CVE-2026-110203 abuses the regular expression that masks quoted text. According to NVD, escaped or single-quoted double quotes can hide command separators behind an allowlisted prefix, so a second command runs unseen. CVE-2026-110204 concerns command substitution written in the ${ command; } form, which the parser treats as a simple parameter expansion. The advisory says a denied command can be embedded inside an allowlisted echo and executed on bash 5.3 or later, or on ksh93.

CVE-2026-110205 involves glob characters. NVD states that parseCommandLine() discards command substitutions placed next to * or ? wildcards, so a string such as echo *$(...) matches an allowlisted prefix while the substitution still runs. CVE-2026-110206 is the simplest of the set. Placing a command substitution in command position, for instance $(echo touch /tmp/x), passes the echo allowlist check, and the shell then executes the output of that substitution as a command.

Each NVD entry links to a write-up in a public repository of open source CVE research, to the relevant lines of source code in the v3.54.0 release on GitHub, and to a corresponding advisory published by VulnCheck. The VulnCheck advisory titles describe the techniques as auto-approve bypasses via redirect operator stripping, quote masking desynchronisation, funsub command substitution, glob token discarding and command substitution at command position.

The records describe the affected versions as Roo Code through 3.54.0. None of the five NVD entries listed here names a fixed version or carries a vendor statement. The practical effect, as described in the advisories, is that a user who turns on auto-approval and relies on a denylist to block dangerous commands cannot assume that denylist holds when the agent processes untrusted content.

The Agentic Times has not independently verified the proof-of-concept commands described in the advisories.