Roo Code: five ways to slip denied commands past auto-approve

01What happened

Minqiang Gui and Siyu Lou found five ways to defeat the shell command allowlist in Roo Code, an AI coding agent extension for VS Code. VulnCheck published an advisory for each on October 13, 2026, and the researchers published write-ups with working proof-of-concept commands.

02How it works

Every one of the five is an interpretation conflict, CWE-436: Roo Code's approval check parses a command one way and the shell runs it another. The checker strips redirection operators, masks quotes, discards command substitutions that sit next to glob characters, and reads a ${ command; } substitution as a parameter expansion. In each case it sees an allowlisted prefix such as echo while bash executes a different, denied command.

03Who is affected

Developers who still run the Roo Code extension with a command allowlist are exposed, across every release up to and including v3.54.0. VulnCheck's vectors need no attacker privileges on the machine, only content the agent reads, which it describes as indirect prompt injection.

04What to do

Remove the Roo Code extension or move to a maintained coding agent, because no patched version exists. Until then, turn auto-approval off so each shell command needs a human click.

Questions people ask

Is Roo Code patched against these auto-approve bypasses?

No patch exists for the five Roo Code bypasses. The RooCodeInc/Roo-Code repository is archived and read-only, v3.54.0 from May 15, 2026 is its final release, and none of the five VulnCheck advisories lists a fixed version. Anyone who still has the extension installed should remove it or switch to a maintained coding agent.

Am I affected if I never turned on auto-approval in Roo Code?

Roo Code prompts for a click on each shell command when no allowlist is active, and an allowlist is exactly what these five flaws defeat. Developers who approve every command by hand still face the ordinary risk of an agent acting on injected instructions, but not the silent execution that these CVEs describe.

What do the published proof-of-concept payloads for Roo Code do?

The write-up for CVE-2026-110202 runs a command beginning with a bare redirect operator, which Roo Code reads as an allowlisted echo call. Bash instead creates a file named echo and runs the denied command that follows, dropping a marker file under /tmp. The other write-ups use the same shape: an allowed prefix for the checker, a denied command for the shell.

Sources 5 links, all fetched

1. 1vulncheck.comVulnCheck Advisory
2. 2github.comResearcher Write-Up
3. 3vulncheck.comQuote Masking Advisory
4. 4github.comDisclosure Repository
5. 5github.comArchived Repository