# Roo Code: five ways to slip denied commands past auto-approve

> Five command-approval bypasses in Roo Code have no patch coming: the AI coding extension shut down in May 2026.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-13
- **CVE:** CVE-2026-110202
- **CVSS:** 7.7
- **Affects:** Roo Code
- **Research by:** Minqiang Gui, Siyu Lou
- **Primary source:** https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-redirect-operator-stripping
- **Page:** https://theinjection.dev/items/roo-code-auto-approve-bypasses/

Roo Code 3.54.0 and earlier approve denied shell commands in five different ways, each filed as a CVE on October 13. The AI coding extension shut down in May 2026 and its repository is archived, so no fix will ship.

## What happened

Minqiang Gui and Siyu Lou found five ways to defeat the shell command allowlist in Roo Code, an AI coding agent extension for VS Code. VulnCheck published an advisory for each on October 13, 2026, and the researchers published write-ups with working proof-of-concept commands.

## How it works

Every one of the five is an interpretation conflict, CWE-436: Roo Code's approval check parses a command one way and the shell runs it another. The checker strips redirection operators, masks quotes, discards command substitutions that sit next to glob characters, and reads a ${ command; } substitution as a parameter expansion. In each case it sees an allowlisted prefix such as echo while bash executes a different, denied command.

## Who is affected

Developers who still run the Roo Code extension with a command allowlist are exposed, across every release up to and including v3.54.0. VulnCheck's vectors need no attacker privileges on the machine, only content the agent reads, which it describes as indirect prompt injection.

## What to do

Remove the Roo Code extension or move to a maintained coding agent, because no patched version exists. Until then, turn auto-approval off so each shell command needs a human click.

## Quick facts

- **Affected:** Roo Code 3.54.0 and earlier, which is every release
- **CVEs:** CVE-2026-110202, 110203, 110204, 110205, 110206
- **CVSS:** 7.7 CVSS v4.0 for each, from NVD; 8.8 on CVSS 3.1
- **Fixed in:** No fixed version: the repository was archived on May 15, 2026 and v3.54.0 is the last release
- **Found by:** Minqiang Gui and Siyu Lou, credited by VulnCheck
- **Disclosed:** October 13, 2026
- **Attack type:** Approval bypass through indirect prompt injection, CWE-436

## Questions

### Is Roo Code patched against these auto-approve bypasses?

No patch exists for the five Roo Code bypasses. The RooCodeInc/Roo-Code repository is archived and read-only, v3.54.0 from May 15, 2026 is its final release, and none of the five VulnCheck advisories lists a fixed version. Anyone who still has the extension installed should remove it or switch to a maintained coding agent.

### Am I affected if I never turned on auto-approval in Roo Code?

Roo Code prompts for a click on each shell command when no allowlist is active, and an allowlist is exactly what these five flaws defeat. Developers who approve every command by hand still face the ordinary risk of an agent acting on injected instructions, but not the silent execution that these CVEs describe.

### What do the published proof-of-concept payloads for Roo Code do?

The write-up for CVE-2026-110202 runs a command beginning with a bare redirect operator, which Roo Code reads as an allowlisted echo call. Bash instead creates a file named echo and runs the denied command that follows, dropping a marker file under /tmp. The other write-ups use the same shape: an allowed prefix for the checker, a denied command for the shell.

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-redirect-operator-stripping)
2. [Researcher Write-Up](https://github.com/7rah/oss-cve/blob/6adb836d24ca446fd168c3acdc4c170beb77fe0f/roocode-group14-redirect.md)
3. [Quote Masking Advisory](https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-quote-masking-desynchronization)
4. [Disclosure Repository](https://github.com/7rah/oss-cve)
5. [Archived Repository](https://github.com/RooCodeInc/Roo-Code)