CVE-2025-54377

Katalog CVE

CVSS 7.8 · High EPSS 1,1%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada roocode roo code. Skor CVSS 3.1 7.8 (High) menurut github.com.

Deskripsi (NVD)

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode does not validate line breaks (\n) in its command input, allowing potential bypass of the allow-list mechanism. The project appears to lack parsing or validation logic to prevent multi-line command injection. When commands are evaluated for execution, only the first line or token may be considered, enabling attackers to smuggle additional commands in subsequent lines. This is fixed in version 3.23.19.

Rincian

Terbit di NVD

23 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-p278-52x9-cffx exploit · advisory vendor
• https://github.com/RooCodeInc/Roo-Code/commit/9d434c2db9b20eb5c78b698cb2b0037cd2074534 patch