CVE-2026-110203

Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine. Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separato...

CVE-2026-110203 Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization

Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine. Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separato...

CVE-2026-110203

Roo-Code versions through 3.54.0 are vulnerable to a command approval bypass caused by a quote-masking regex flaw in the parseCommandLine() function. Attackers can utilize indirect prompt injection with escaped or single-quoted double quotes to conceal command separators behind allowlisted prefix...