On 13 October 2026, VulnCheck published five CVEs, CVE-2026-110202 through CVE-2026-110206, for Roo Code, the open source AI coding agent that runs as a VS Code extension. Each one is a way to make Roo Code's command parser approve a shell command that the user's allowlist should have blocked. All five affect Roo Code through 3.54.0, and VulnCheck's advisories don't list a fixed version.
What's affected
Roo Code can auto-approve terminal commands that match an allowlist of prefixes, such as echo or git status. The parser decides what the "command" is, and the shell decides what actually runs. These CVEs are cases where the two disagree.
All five are rated CVSS 4.0 7.7 and CVSS 3.1 8.8, and all assume indirect prompt injection: text in a file, issue or web page that the agent reads and then acts on.
- CVE-2026-110202: a bare redirect prefix makes
getCommandDecision()match the redirect target, such asecho, while the shell runs the denied command. - CVE-2026-110203: the quote-masking regex in
parseCommandLine()can be confused by escaped or single-quoted double quotes, hiding a command separator behind an allowlisted prefix. - CVE-2026-110204: a brace-style command substitution is treated as a parameter expansion. The NVD entry says this works on bash 5.3 and later or ksh93.
- CVE-2026-110205: command substitutions placed next to the glob characters
*or?are discarded by the parser but still run by the shell. - CVE-2026-110206: a command substitution in command position passes an
echoallowlist check, and the shell executes its output.
The shapes look like this. Each starts with something on the allowlist:
echo *$(DENIED_COMMAND) # CVE-2026-110205 shape
$(echo DENIED_COMMAND) # CVE-2026-110206 shape
echo ${ DENIED_COMMAND; } # CVE-2026-110204 shape, bash 5.3+ or ksh93
VulnCheck credits Minqiang Gui and Siyu Lou on CVE-2026-110206. When we checked on 18 October, Roo Code's GitHub releases page showed 3.54.0, dated 15 May, as the latest release.
How to check if you're exposed
-
Find installs. On each developer machine:
code --list-extensions --show-versions | grep -i rooAny version at or below 3.54.0 is in scope.
-
Check whether command auto-approval is on. The bypasses only matter if Roo Code is allowed to run commands without asking. Open Roo Code's auto-approve settings and look at command execution and the allowed commands list.
-
Review the allowlist. Short, generic prefixes such as
echo,catorlsare exactly what these bypasses ride on. -
Check your shell. CVE-2026-110204 depends on bash 5.3+ or ksh93:
bash --version | head -1
What to do now
There's no patched release to install, so the fix is configuration and containment.
- Turn off auto-approval for command execution in Roo Code. Approve each command by hand until a fixed version ships.
- If you must keep auto-approval, shrink the allowlist to full, specific commands and remove bare prefixes like
echo. Note that CVE-2026-110206 and CVE-2026-110205 both pass with anechoprefix. - Run the agent in a disposable environment, such as a dev container or VM without your cloud credentials, SSH keys or production tokens mounted.
- Limit what the agent reads. Indirect prompt injection needs a channel. Be careful pointing the agent at untrusted issues, pull requests from forks, or arbitrary web pages while it can run commands.
- Watch for a fixed release and test it against the patterns above before turning auto-approval back on.
Why it matters
Command allowlists in coding agents are text matchers sitting in front of a full shell language. Redirects, quoting, brace substitutions and globbing each give the shell another way to run something the matcher didn't see. Five CVEs from one parser in one disclosure is a sign of how wide that gap is.
This isn't unique to one tool. In September, Ollama's experimental agent mode got a CVE for the same class of bug, where control operators appended to an approved command bypassed the approval check. Any agent that approves commands by prefix is worth testing against these shapes.
The durable control is isolation. A prompt-injected command that runs in a throwaway container with no secrets does far less harm than one that runs in your home directory.
Try it yourself
Take your agent's current allowlist and try the three shapes above in a scratch container, replacing the placeholder with a harmless command like touch /tmp/bypass-test. Check whether the file appears. Then look at how unpatched issues like this get tracked from disclosure to fix.
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I approve every command manually?
These CVEs bypass auto-approval. If Roo Code asks you before running each command and you read it, the parser's mistake doesn't get a chance to run anything on its own.
Is there a fixed version?
VulnCheck's advisories list Roo Code through 3.54.0 as affected and name no fixed version. As of 18 October, 3.54.0 was the latest release on GitHub.
Why does an echo allowlist entry matter so much?
Several of these bypasses wrap the denied command inside or after an allowlisted prefix. A harmless-looking prefix like echo is enough for the parser to approve the whole line.
