https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-15T23:26:47.537900+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-110204 fkie_cve-2026-110204 2026-10-15T23:26:47.539853+00:00

Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93.

 https://db.gcve.eu/vuln/ghsa-mfc9-vhw7-f5w9 GHSA-mfc9-vhw7-f5w9 2026-10-15T23:26:47.539916+00:00

Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93.