CVE-2025-65946: fallo de gravedad alta en RooCodeInc Roo-Code
Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.1epss 0.7%
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list prefixes. This issue has been patched in version 3.26.7.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
RooCodeInc · Roo-CodeCVEs relacionadas — RooCodeInc Roo-Code
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-63108HIGHRoo Code 3.54.0 Command Injection via Parameter Expansion ParsingEPSS 1.8%CVE-2025-58371CRITICALRoo Code is vulnerable to command injection via GitHub actions workflowEPSS 1.5%CVE-2025-54377HIGHRoo Code Lacks Line Break Validation in its Command Execution ToolEPSS 1.1%CVE-2025-53536HIGHRoo Code allows Potential Remote Code Execution via .vscode/settings.jsonEPSS 0.8%CVE-2025-57771HIGHRoo-Code potential remote code execution via auto-execute command parsing flawEPSS 0.7%CVE-2025-53098HIGHRoo Code Vulnerable to Potential Remote Code Execution via Model Context ProtocolEPSS 0.7%