CVE-2026-81835mediumCWE-74CWE-94

CVE-2026-81835: falha de média gravidade em RooCodeInc Roo-Code

RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Roo-Code

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

33Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 5.1epss 0.3%
A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instructions of the file malicious_mcp_server.py of the component MCP Integration Trust Model. The manipulation leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
RooCodeInc · Roo-Code
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — RooCodeInc Roo-Code

No mesmo produto, das mais perigosas para as menos.

CVE-2026-63108HIGHRoo Code 3.54.0 Command Injection via Parameter Expansion ParsingEPSS 1.8%CVE-2025-58371CRITICALRoo Code is vulnerable to command injection via GitHub actions workflowEPSS 1.5%CVE-2025-54377HIGHRoo Code Lacks Line Break Validation in its Command Execution ToolEPSS 1.1%CVE-2025-53536HIGHRoo Code allows Potential Remote Code Execution via .vscode/settings.jsonEPSS 0.8%CVE-2025-57771HIGHRoo-Code potential remote code execution via auto-execute command parsing flawEPSS 0.7%CVE-2025-65946HIGHRoo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation BugEPSS 0.7%