CVE-2026-81837

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-81835: Improper Control of Generation of Code

A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetchinstructions of the file maliciousmcpserver.py of the component MCP Integration Trust Model. The manipulation leads to code injection. The attack is possible to be carried out remotely...

CVE-2026-81836: Cleartext Transmission of Sensitive Information

A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback. The manipulation results in cleartext transmission of sensitive information. The attack may be performed fro...

CVE-2026-81837: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-81837 RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-81837

A path traversal vulnerability affects RooCodeInc Roo-Code versions up to 3.51.1 , specifically in the path.resolve function within src/core/tools/ApplyPatchTool.ts . The flaw allows remote exploitation with low complexity and no required privileges, though user interaction is needed. A proof-of-...

CVE-2026-81837 RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-81836

A vulnerability in RooCodeInc Roo-Code (up to version 3.51.1) affects the OAuth Callback component in the file src/integrations/claude-code/oauth.ts, where sensitive information is transmitted in cleartext. The attack is remote with no required authentication but carries high complexity . A proof...

CVE-2026-81836 RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission

A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback. The manipulation results in cleartext transmission of sensitive information. The attack may be performed fro...

CVE-2026-81836 RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission

A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback. The manipulation results in cleartext transmission of sensitive information. The attack may be performed fro...

CVE-2026-81835 RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection

A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetchinstructions of the file maliciousmcpserver.py of the component MCP Integration Trust Model. The manipulation leads to code injection. The attack is possible to be carried out remotely...

CVE-2026-81835

RooCodeInc Roo-Code (up to version 3.51.1 ) is vulnerable to code injection via the fetch_instructions function in malicious_mcp_server.py, part of the MCP Integration Trust Model component. The attack can be carried out remotely with low complexity and low privileges, requiring user interaction....

CVE-2026-81833

A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/helpers.ts of the component CodeIndexManager. Performing a manipulation results in code injection. Remote exploitation of the attack is...

CVE-2026-81834

A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a manipulation can lead to code injection. The attack can be executed remotely. The exploit has been made available to th...

CVE-2026-81834 RooCodeInc Roo-Code README File ExecaTerminalProcess code injection

A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a manipulation can lead to code injection. The attack can be executed remotely. The exploit has been made available to th...

CVE-2026-81834 RooCodeInc Roo-Code README File ExecaTerminalProcess code injection

A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a manipulation can lead to code injection. The attack can be executed remotely. The exploit has been made available to th...

EUVD-2026-67231

A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a manipulation can lead to code injection. The attack can be executed remotely. The exploit has been made available to th...

CVE-2026-81834

A code injection vulnerability exists in RooCodeInc Roo-Code (versions up to 3.51.1 ), specifically in the ExecaTerminalProcess function within the README File Handler component. The flaw allows remote attackers to inject code by manipulating this function. A public proof-of-concept exploit is av...

CVE-2026-81833

Roo-Code (RooCodeInc) up to version 3.51.1 is affected by a code injection vulnerability in the optimizeQuery function within src/utils/helpers.ts of the CodeIndexManager component. Manipulation of this function allows remote code injection with low impact on confidentiality, integrity, and avail...

CVE-2026-81833 RooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection

A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/helpers.ts of the component CodeIndexManager. Performing a manipulation results in code injection. Remote exploitation of the attack is...