CVE-2025-54377: Roocode Roo Code RCE Vulnerability

CVE-2025-54377 Overview

CVE-2025-54377 affects Roo Code, an AI-powered autonomous coding agent that runs inside developer editors. Versions 3.23.18 and earlier fail to validate line breaks (\n) in command input, allowing attackers to bypass the allow-list mechanism. The command validation logic evaluates only the first line or token, so additional commands smuggled on subsequent lines execute without inspection. This weakness is classified as [CWE-77] Improper Neutralization of Special Elements used in a Command. The maintainers fixed the issue in version 3.23.19.

Critical Impact
Local attackers with low privileges can smuggle unauthorized shell commands past the allow-list, achieving high impact to confidentiality, integrity, and availability on the developer host.

Affected Products

Roo Code (roocode:roo_code) versions 3.23.18 and earlier
VS Code environments running the vulnerable Roo Code extension
Developer workstations executing agent-driven commands through Roo Code

Discovery Timeline

2025-07-23 - CVE-2025-54377 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54377

Vulnerability Analysis

Roo Code parses agent-generated commands and evaluates them against an allow-list before execution. The parser splits commands using shell chaining operators such as &&, ||, ;, and |, but it does not treat newline characters (\r\n, \n, \r) as command separators. When the AI agent or an upstream prompt injection provides a multi-line command string, only the first line reaches the validation logic. Subsequent lines pass through to the shell unchecked.

This command injection primitive turns a trusted allow-list into an incomplete filter. An attacker who influences the agent's command output, for example through indirect prompt injection in repository files or documentation, can append arbitrary shell commands after a benign first line.

Root Cause

The parseCommand function in webview-ui/src/utils/command-validation.ts used shell-quote to tokenize a single-line input. The function did not pre-split the incoming string on line terminators before running the allow-list check. Any content after a newline was concatenated back into the executed command string, bypassing validation entirely.

Attack Vector

Exploitation requires a local attack vector with low privileges and no user interaction beyond normal agent operation. An attacker delivers a crafted multi-line command payload to the Roo Code agent, typically via prompt injection embedded in source files, issue descriptions, or model output. The first line matches an allow-listed command such as git status, while subsequent lines execute attacker-controlled operations with the developer's privileges.

typescript

/**
 * Split a command string into individual sub-commands by
 * chaining operators (&&, ||, ;, or |) and newlines.
 *
 * Uses shell-quote to properly handle:
 * - Quoted strings (preserves quotes)
 * - Subshell commands ($(cmd) or `cmd`)
 * - PowerShell redirections (2>&1)
 * - Chain operators (&&, ||, ;, |)
 * - Newlines as command separators
 */
export function parseCommand(command: string): string[] {
	if (!command?.trim()) return []

	// Split by newlines first (handle different line ending formats)
	// This regex splits on \r\n (Windows), \n (Unix), or \r (old Mac)
	const lines = command.split(/\r\n|\r|\n/)
	const allCommands: string[] = []

	for (const line of lines) {
		// Skip empty lines
		if (!line.trim()) continue

		// Process each line through the existing parsing logic
		const lineCommands = parseCommandLine(line)
		allCommands.push(...lineCommands)
	}
}

Source: Roo Code security patch commit 9d434c2

Detection Methods for CVE-2025-54377

Indicators of Compromise

Roo Code extension version 3.23.18 or earlier present in the VS Code extensions directory
Shell history entries showing commands whose first line is allow-listed but followed by unexpected commands after a newline
Unexpected child processes spawned by the VS Code or Roo Code agent process, such as curl, wget, bash -c, or powershell -enc
Outbound network connections from developer workstations to attacker-controlled hosts shortly after agent activity

Detection Strategies

Inventory installed Roo Code versions across developer endpoints and flag any instance below 3.23.19
Monitor process ancestry for shells spawned by the Roo Code agent that execute commands outside the configured allow-list
Inspect command strings passed to the agent for embedded \r, \n, or \r\n sequences prior to shell execution

Monitoring Recommendations

Enable endpoint process telemetry on developer workstations to capture full command lines and parent-child process relationships
Alert on Roo Code agent processes writing to sensitive paths such as ~/.ssh, ~/.aws, or credential stores
Correlate agent execution events with outbound network traffic to identify data exfiltration attempts following command injection

How to Mitigate CVE-2025-54377

Immediate Actions Required

Upgrade Roo Code to version 3.23.19 or later on every developer workstation
Audit recent agent command execution logs for multi-line payloads that may indicate exploitation attempts
Review repositories, issues, and external content processed by Roo Code for prompt injection payloads

Patch Information

The fix is delivered in Roo Code version 3.23.19 via commit 9d434c2db9b20eb5c78b698cb2b0037cd2074534. The patch updates parseCommand in webview-ui/src/utils/command-validation.ts to split incoming command strings on \r\n, \n, and \r before running each line through the existing allow-list logic. See the GitHub Security Advisory GHSA-p278-52x9-cffx for full details.

Workarounds

Disable Roo Code auto-approval for shell commands until the extension is patched, forcing manual review of every agent command
Restrict the agent's execution environment using OS-level controls such as restricted shells, AppArmor, or SELinux profiles
Run Roo Code inside a development container or virtual machine with no access to production credentials or sensitive files

bash

# Verify the installed Roo Code extension version and upgrade if vulnerable
code --list-extensions --show-versions | grep -i roo-cline
code --install-extension RooVeterinaryInc.roo-cline --force