https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-15T23:34:39.314017+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-110204 CVE-2026-110204 — Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution 2026-10-15T23:34:39.314818+00:00

Affected: RooCodeInc Roo-Code

Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93.