CVE-2025-65946
Last modified
CVE-2025-65946 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list prefixes. EPSS estimates a 0.61% chance of exploitation in the next 30 days.
Description
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list prefixes. This issue has been patched in version 3.26.7.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Roocode | Roo Code | < 3.26.7 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-65946?
How severe is CVE-2025-65946?
How do I fix CVE-2025-65946?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-6594Improper Neutralization of Input During Web Page Generation …4.7
- CVE-2025-65940Rejected reason: Not used
- CVE-2025-65941Rejected reason: Not used
- CVE-2025-65942VictoriaMetrics is a scalable solution for monitoring and ma…2.7
- CVE-2025-65944Sentry-Javascript is an official Sentry SDKs for JavaScript.…5.1
- CVE-2025-65945auth0/node-jws is a JSON Web Signature implementation for No…7.5
- CVE-2025-65947thread-amount is a tool that gets the amount of threads in t…8.7
- CVE-2025-6595Improper Neutralization of Input During Web Page Generation …4.7
- CVE-2025-65950WBCE CMS is a content management system. In versions 1.6.4 a…8.8
- CVE-2025-65951Inside Track / Entropy Derby is a research-grade horse-racin…8.7
- CVE-2025-65952Console is a network used to control Gorilla Tag mods' users…8.7
- CVE-2025-65953NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …6
Are you affected by CVE-2025-65946?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST