CVE-2025-54377

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode does not validate line breaks (\n) in its command input, allowing potential bypass of the allow-list mechanism. The project appears to lack parsing or validation logic to prevent multi-line command injection. When commands are evaluated for execution, only the first line or token may be considered, enabling attackers to smuggle additional commands in subsequent lines. This is fixed in version 3.23.19.

• CWE-77

• https://github.com/RooCodeInc/Roo-Code/commit/9d434c2db9b20eb5c78b698cb2b0037cd2074534Patch
• https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-p278-52x9-cffxExploit, Vendor Advisory
• https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-p278-52x9-cffxExploit, Vendor Advisory

Published

Jul 23, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5437A vulnerability classified as critical has been found in Mul…6.9
• CVE-2025-54370PhpOffice/PhpSpreadsheet is a pure PHP library for reading a…8.7
• CVE-2025-54371Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2025-54373OpenEMR is a free and open source electronic health records …6.5
• CVE-2025-54374Eidos is an extensible framework for Personal Data Managemen…8.8
• CVE-2025-54376Hoverfly is an open source API simulation tool. In versions …7.5
• CVE-2025-54378HAX CMS allows you to manage your microsite universe with PH…8.3
• CVE-2025-54379LF Edge eKuiper is a lightweight IoT data analytics and stre…9.8
• CVE-2025-5438A vulnerability was found in Linksys RE6500, RE6250, RE6300,…8.8
• CVE-2025-54380Opencast is a free, open-source platform to support the mana…6.5
• CVE-2025-54381BentoML is a Python library for building online serving syst…9.9
• CVE-2025-54382Cherry Studio is a desktop client that supports for multiple…8.8