CVE-2025-58374

Katalog CVE

CVSS 7.8 · High EPSS 0,21%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada roocode roo code. Skor CVSS 3.1 7.8 (High) menurut github.com.

Deskripsi (NVD)

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle scripts, if a repository’s package.json file contains a malicious postinstall script, it would be executed automatically without user approval. This means that enabling auto-approved commands and opening a malicious repo could result in arbitrary code execution. This is fixed in version 3.26.0.

Rincian

Terbit di NVD

6 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-c292-qxq4-4p2v advisory vendor
• https://github.com/RooCodeInc/Roo-Code/pull/7390/files product
• https://github.com/RooCodeInc/Roo-Code/releases/tag/v3.26.0 release notes