CVE-2026-82537

Roo-Code, an AI coding agent extension, through version 3.54.0 contains an auto-approve bypass (CWE-436 interpretation conflict) in which the command-approval gate's shell parser and bash disagree about how a hash character is handled. An attacker crafts a command string in which an allowlisted word is immediately followed by a hash character, a separator, and a denied command; the approval gate parses the string as an approved (allowlisted) command, while bash executes the denied command. As a result, the attacker's denied shell command runs with the agent's auto-execute privileges on the developer's machine, giving high impact to confidentiality, integrity and availability per the CVSS 4.0 score of 7.7 (High). Affected users are developers running Roo-Code 3.54.0 or earlier with command auto-approval enabled, especially where the agent processes untrusted content. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known; EPSS estimates a 0.3% probability of exploitation in the next 30 days.

What to do: Update Roo-Code to a release newer than 3.54.0 (the first fixed version is not stated in the available data, so verify the changelog for the auto-approve bypass fix). Until patched, disable auto-approval of shell commands or tighten the allowlist, and review any commands the agent proposes when handling untrusted files, web pages, or model output. Developers can check their installed extension version in the IDE's extension panel to confirm whether they are affected.