CVE-2025-58372 is a high severity (CVSS 8.1) flaw in Roo Code, the AI coding agent for editors. Versions 3.25.23 and below did not protect .code-workspace files the way they protect the .vscode folder, so auto-approved writes could plant tasks that run later. Upgrade to 3.26.0 or newer.
What's affected
Roo Code versions 3.25.23 and below, per the record and the release notes. The fixed version is 3.26.0.
The risk applies when the agent is configured to auto-approve file writes, as the record states.
The record says an attacker able to influence prompts, for example through prompt injection, could cause malicious workspace settings or tasks to be written.
How to check if you're exposed
Check the installed extension version.
code --list-extensions --show-versions | grep -i roo
Then review your agent settings. If file writes are auto-approved, note which folders the agent may write to. Look at any .code-workspace files in your projects and compare their tasks and settings with what you expect.
What to do now
- Update Roo Code to 3.26.0 or later.
- Turn off auto-approval for file writes unless you need it, or restrict it to a narrow folder.
- Open your .code-workspace files and remove tasks or settings you did not write.
- Be careful about the content you feed an agent from outside sources, such as issues, web pages or documents, since prompt injection starts there.
Why it matters
Editors can run tasks automatically when a workspace opens. The project already guarded the .vscode folder against agent writes, but the .code-workspace file offers the same abilities and was left unprotected. A write to that file by an auto-approving agent could therefore turn into code execution on the next open.
The weakness is a permissions gap, tracked as incorrect permission assignment for a critical resource, combined with the broader risk that an agent can be steered by text it reads.
The record classifies the weakness as CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-94 (Code Injection).
Auto-approval settings are convenient and also a trust decision. A short list of paths the agent may write, and a hard refusal for any file that can configure execution, is a sensible baseline for any coding agent, not only this one.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Does this need auto-approve to be switched on?
The record says the issue applies if the agent was configured to auto-approve file writes. Turning it off reduces exposure, but you should still update.
Which version fixes it?
Roo Code 3.26.0.
Sources
Last reviewed: 18 October 2026.
