CVE-2026-82536

Roo-Code through 3.54.0, an AI coding agent that runs on developers' workstations, incompletely validates shell commands against the user's allowlist (CWE-184) because the bash pipe operator is missing from the command parser's operator token set. An attacker who can influence the commands the agent constructs (for example, via untrusted project content or injected instructions) can append the stderr-redirecting pipe operator (|&) after an allowlisted prefix followed by a denied command; the parser approves the pipeline, but bash executes every segment of it. The denied command therefore runs with the agent's auto-execute privileges on the developer's machine, giving the attacker local command execution and potential access to source code, credentials, or local files. Any developer running Roo-Code 3.54.0 or earlier with shell-command auto-approve enabled is affected; the flaw is exploited through the agent's normal command flow on the workstation rather than via a network service. No exploitation in the wild, public proof-of-concept, or KEV listing is currently known, and CVSS 4.0 rates the issue 7.7 (High).

What to do: Upgrade Roo-Code to the latest available release newer than 3.54.0 and confirm the first patched version in the vendor's advisory. Until patched, disable auto-approve/auto-execute for shell commands or tighten the command allowlist, and review recent agent-run pipelines for unexpected piped commands. Treat untrusted content the agent processes (repositories, tool/MCP output, chat text) as a potential source of injected commands.