CVE-2026-110205: High Command Approval Bypass in Roo Code

CVE-2026-110205 is a High severity (CVSS 8.8) command approval bypass in Roo Code through 3.54.0. A parsing gap lets a command substitution next to a glob character slip past the allow list. We could not confirm a fixed version, so disable auto-approval for commands and check the project.

What's affected

The record says Roo Code through 3.54.0 is affected. The VulnCheck advisory we read names no fixed version, so we do not state one. Check the Roo Code releases and changelog before you choose a target version.

The weakness is CWE-184, incomplete list of disallowed inputs. Per the record, the function parseCommandLine() drops command substitutions that sit next to a star or question mark glob character when it splits a command for checking. A command can then match an allowed prefix while carrying a substitution that was never checked against the deny list.

Severity differs by source. The record gives 8.8 (High) and VulnCheck gives 7.7 (High). The condition is that auto-approval of commands is enabled, and that the model is steered by indirect prompt injection, meaning hostile text in a file, web page or tool result that the agent reads.

How to check if you're exposed

Check the installed Roo Code extension version in your editor's extensions list. Versions up to 3.54.0 are in range.

Then review your Roo Code settings for auto-approval of command execution and for the allow list and deny list of command prefixes. If auto-approval for commands is off, every command waits for a human click, and the flaw does not give silent execution.

Think about where the agent reads content from. Repositories you clone, issues you open, web pages and documents it fetches are all places hostile instructions can hide. Review recent task histories for commands you did not expect. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.

What to do now

1. Turn off auto-approval for command execution until a fixed release is confirmed.
2. If you must keep it, shrink the allow list to a few exact, harmless commands and avoid broad prefixes such as echo.
3. Run the agent in a container or a disposable development environment with no access to production credentials or personal keys.
4. Do not point the agent at untrusted repositories or content while auto-approval is on.
5. Check Roo Code release notes and the VulnCheck record for a fix, then upgrade and test that substitutions are checked as expected.

Why it matters

AI coding agents are built around a trust decision. The tool asks a human to approve commands, and auto-approval removes that step for commands that look safe. A command checker that misses even one syntax feature turns the allow list from a safeguard into a suggestion.

Shell syntax is full of such features: substitutions, globs, quoting and expansion. Any checker that splits a command string by hand is likely to misread some of them. The safer design is to treat the model's output as untrusted and to limit what the process can reach even after a command is approved. The record does not mark this CVE as known exploited, and none of the pages we read say it is.

Quick check

Sources

• VulnCheck advisory

Last reviewed: 18 October 2026.