CVE-2026-63108

The record

Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter expansions with opaque placeholders before extracting command substitutions, causing the containsDangerousSubstitution guard to miss nested payloads, which are then auto-approved based on the outer allowlisted command prefix and executed by the shell via execa, enabling arbitrary command execution.

Affected packages

Related vulnerabilities

• CVE-2026-119567 vsftpd through 3.0.5 contains an access control bypass vulnerability that allows… CWE-184
• CVE-2026-96196 Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an… CWE-184
• CVE-2026-117530 In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete… CWE-184
• CVE-2026-115845 An incomplete list of disallowed inputs in the Python code validator of the run_script… CWE-184
• CVE-2026-115751 Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request… CWE-184
• CVE-2026-114615 Authlib is a Python library which builds OAuth and OpenID Connect servers. CWE-184
• CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184
• CVE-2026-114728 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184