CVE-2025-58370

Katalog CVE

CVSS 8.1 · High EPSS 0,44%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada roocode roo code. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent was configured to auto-approve execution of certain commands, an attacker able to influence prompts could abuse this weakness to execute additional arbitrary commands alongside the intended one. This is fixed in version 3.26.0.

Rincian

Terbit di NVD

5 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-2rm5-cvcm-7592 advisory vendor