CVE-2025-57771

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions prior to 3.25.5, Roo-Code fails to properly handle process substitution and single ampersand characters in the command parsing logic for auto-execute commands. If a user has enabled auto-approved execution for a command such as ls, an attacker who can submit crafted prompts to the agent may inject arbitrary commands to be executed alongside the intended command. Exploitation requires attacker access to submit prompts and for the user to have enabled auto-approved command execution, which is disabled by default. This vulnerability could allow an attacker to execute arbitrary code. The issue is fixed in version 3.25.5.

• CWE-78

• https://github.com/RooCodeInc/Roo-Code/commit/de359a465c67aefc67553aa2b464591b602c4bdc
• https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-wrh9-463x-7wvv

Published

Aug 22, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-57766Fides is an open-source privacy engineering platform. Prior …4.8
• CVE-2025-57767Asterisk is an open source private branch exchange and telep…7.5
• CVE-2025-57768Phproject is a high performance full-featured project manage…6.9
• CVE-2025-57769FreshRSS is a free, self-hostable RSS aggregator. Versions 1…6.1
• CVE-2025-5777Insufficient input validation leading to memory overread whe…7.5
• CVE-2025-57770The open-source identity infrastructure software Zitadel all…5.3
• CVE-2025-57772DataEase is an open source business intelligence and data vi…9.8
• CVE-2025-57773DataEase is an open source business intelligence and data vi…9.8
• CVE-2025-57774There is an out of bounds write vulnerability due to imprope…8.5
• CVE-2025-57775There is a heap-based Buffer Overflow vulnerability due to i…8.5
• CVE-2025-57776There is an out of bounds write vulnerability due to imprope…8.5
• CVE-2025-57777There is an out of bounds write vulnerability due to imprope…8.5