CVE-2026-110202

Summary

Roo Code's command approval system can be bypassed by prefixing denied shell commands with a bare >& redirect, allowing attackers to auto-approve commands that would otherwise be denied. This creates a high-impact vulnerability where attackers can execute arbitrary shell commands on developer machines.

Exploitability

The exploit is relatively straightforward to execute as it requires only prefixing a denied command with >& and leveraging indirect prompt injection to make the allowlist match a redirect target like echo, with no complex preconditions needed.

Blast radius

If exploited, this vulnerability could lead to full system compromise of developer machines through arbitrary command execution, potentially enabling attackers to access sensitive code repositories, credentials, and other development assets.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Roo Code 3.55.0 or later to address the command approval bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.