CVE-2025-58374 Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle...

CVE-2025-58374

Summary (CVE-2025-58374): Roo Code versions 3.25.23 and earlier allow an auto-approved npm install that can execute a repository’s postinstall script, enabling arbitrary code execution. Root cause: npm install is in the default auto-approve list, so malicious postinstall scripts run without user ...

PT-2025-36345

Name of the Vulnerable Software and Affected Versions: Roo Code versions 3.25.23 and below Description: Roo Code is an AI-powered autonomous coding agent. Versions 3.25.23 and below include npm install in a default list of auto-approved commands. Because npm install executes lifecycle scripts, a...

Malicious code in izar-neptune-spectron-webdriver-install (npm)

The package izar-neptune-spectron-webdriver-install was found to contain malicious code...

Malicious code in janus-install-bunyan-sync (npm)

The package janus-install-bunyan-sync was found to contain malicious code...

Malicious code in module-xenos-install-oauth (npm)

The package module-xenos-install-oauth was found to contain malicious code...

Malicious code in interferometry-install-phenomic-mysql (npm)

The package interferometry-install-phenomic-mysql was found to contain malicious code...

MAL-2025-46238 Malicious code in taphonomy-terser-version-install (npm)

The package taphonomy-terser-version-install was found to contain malicious code...

MAL-2025-44754 Malicious code in janus-install-bunyan-sync (npm)

The package janus-install-bunyan-sync was found to contain malicious code...

MAL-2025-45212 Malicious code in module-xenos-install-oauth (npm)

The package module-xenos-install-oauth was found to contain malicious code...

MAL-2025-44702 Malicious code in install-eleventy-cluster-element-ui (npm)

The package install-eleventy-cluster-element-ui was found to contain malicious code...

CVE-2025-22425

In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2025-38722

In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in exportdmabuf As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland it's a...

CVE-2025-38722

CVE-2025-38722: Linux kernel HABANA Labs export_dmabuf() UAF due to race between descriptor table fd_install() and object destruction in ->release(). Root cause: a descriptor in dma_buf_fd() may be installed and used while the referenced file/object could be freed, leading to use-after-free. M...

CVE-2024-34598

Improper export of component in GoodLock prior to version 2.2.04.95 allows local attackers to install arbitrary applications from Galaxy Store...

CVE-2024-34598

Improper export of component in GoodLock prior to version 2.2.04.95 allows local attackers to install arbitrary applications from Galaxy Store...

PT-2025-35902

Name of the Vulnerable Software and Affected Versions GoodLock versions prior to 2.2.04.95 Description An improper component export in GoodLock allows local attackers to install arbitrary applications from the Galaxy Store. Recommendations Update GoodLock to version 2.2.04.95 or later...

CVE-2025-9864

Rejected reason: This CVE ID was assigned in error to a vulnerability that was both introduced and fixed before the code landed in the Stable channel of Chrome, and has been withdrawn...

Linux Distros Unpatched Vulnerability : CVE-2020-15177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In GLPI before version 9.5.2, the install/install.php endpoint insecurely stores user input into the database as urlbase and urlbaseapi. These settings are...

Linux Distros Unpatched Vulnerability : CVE-2025-50063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: Install. The supported version that is affected is Oracle Java SE: 8u451. Easily exploitable vulnerability allows low...