CVE-2025-65946: falha de alta gravidade em RooCodeInc Roo-Code
Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.7%
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list prefixes. This issue has been patched in version 3.26.7.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
RooCodeInc · Roo-CodeCVEs relacionadas — RooCodeInc Roo-Code
No mesmo produto, das mais perigosas para as menos.
CVE-2026-63108HIGHRoo Code 3.54.0 Command Injection via Parameter Expansion ParsingEPSS 1.8%CVE-2025-58371CRITICALRoo Code is vulnerable to command injection via GitHub actions workflowEPSS 1.5%CVE-2025-54377HIGHRoo Code Lacks Line Break Validation in its Command Execution ToolEPSS 1.1%CVE-2025-53536HIGHRoo Code allows Potential Remote Code Execution via .vscode/settings.jsonEPSS 0.8%CVE-2025-57771HIGHRoo-Code potential remote code execution via auto-execute command parsing flawEPSS 0.7%CVE-2025-53098HIGHRoo Code Vulnerable to Potential Remote Code Execution via Model Context ProtocolEPSS 0.7%