CVE-2025-57771: Roo Code Command Injection RCE Flaw

CVE-2025-57771 Overview

CVE-2025-57771 is a command injection vulnerability affecting Roo Code, an AI-powered autonomous coding agent that integrates with code editors. The vulnerability exists in versions prior to 3.25.5 due to improper handling of process substitution and single ampersand characters in the command parsing logic for auto-execute commands. When a user has enabled auto-approved execution for certain commands (such as ls), an attacker capable of submitting crafted prompts to the agent can inject arbitrary commands to be executed alongside the intended command.

Critical Impact

Successful exploitation allows an attacker to execute arbitrary code on the victim's system through maliciously crafted prompts, potentially leading to complete system compromise.

Affected Products

• Roo Code versions prior to 3.25.5
• Users with auto-approved command execution enabled

Discovery Timeline

• 2025-08-22 - CVE CVE-2025-57771 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-57771

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw resides in how Roo Code parses and processes commands that are designated for auto-execution. The command parsing logic fails to properly sanitize or escape process substitution sequences and single ampersand (&) characters.

When users enable auto-approved execution for common commands, the application is designed to automatically execute these commands without requiring additional confirmation. However, the insufficient input validation allows attackers who can influence the prompts submitted to the AI agent to embed shell metacharacters that break out of the intended command context and execute additional arbitrary commands.

The attack requires the attacker to have access to submit prompts to the Roo Code agent. In scenarios where the AI agent processes external input (such as from untrusted sources or during automated workflows), this becomes a viable attack vector. The default configuration has auto-approved command execution disabled, which serves as a mitigating factor.

Root Cause

The root cause of CVE-2025-57771 is inadequate input sanitization in the command parsing logic. Specifically, the application fails to properly escape or reject process substitution patterns (such as <(command) or >(command) in bash) and single ampersand characters that can be used to chain commands in shell environments. This allows user-controlled input from prompts to influence the final command string that gets executed by the system shell.

Attack Vector

The attack vector is network-based, requiring the attacker to submit specially crafted prompts to the Roo Code agent. The exploitation scenario involves manipulating prompt content to include shell metacharacters that escape the intended command boundaries. For example, if ls is an auto-approved command, an attacker could craft a prompt that causes the agent to execute ls; malicious_command or ls & malicious_command, resulting in arbitrary command execution.

The exploitation chain requires:

1. Attacker access to submit prompts to the Roo Code agent
2. The user must have enabled auto-approved command execution (disabled by default)
3. The attacker crafts a prompt containing shell metacharacters that bypass the command parser

This vulnerability leverages the trust relationship between the AI agent and the underlying operating system shell, where insufficiently validated commands are passed directly for execution.

Detection Methods for CVE-2025-57771

Indicators of Compromise

• Unusual command sequences in shell history containing process substitution patterns or chained commands
• Unexpected outbound network connections from the Roo Code process
• Execution of commands not typically associated with coding operations
• Log entries showing commands with embedded & or process substitution syntax executed via Roo Code

Detection Strategies

• Monitor process creation events for child processes spawned by the Roo Code application
• Implement logging for all commands executed through the auto-execute functionality
• Deploy endpoint detection rules to identify command injection patterns in process arguments
• Review and audit prompts submitted to AI agents for suspicious shell metacharacters

Monitoring Recommendations

• Enable verbose logging for Roo Code command execution activities
• Configure SentinelOne to monitor for suspicious command patterns originating from editor processes
• Implement behavioral analysis to detect anomalous command execution sequences
• Set up alerts for command executions containing shell metacharacters like &, |, ;, or process substitution syntax

How to Mitigate CVE-2025-57771

Immediate Actions Required

• Update Roo Code to version 3.25.5 or later immediately
• Disable auto-approved command execution if updating is not immediately possible
• Review and audit any commands that have been granted auto-approval status
• Restrict the ability to submit prompts to trusted sources only

Patch Information

The vulnerability has been addressed in Roo Code version 3.25.5. The fix improves the command parsing logic to properly handle and sanitize process substitution patterns and single ampersand characters before command execution. Organizations should update to this version or later to remediate the vulnerability.

Technical details of the fix can be reviewed in the GitHub commit. Additional information is available in the GitHub Security Advisory GHSA-wrh9-463x-7wvv.

Workarounds

• Disable auto-approved command execution in Roo Code settings (this is the default configuration)
• Implement network segmentation to limit the sources that can submit prompts to the AI agent
• Use allowlisting to restrict commands available for auto-execution to a minimal safe set
• Consider running Roo Code in a sandboxed or containerized environment to limit the impact of potential command execution

# Disable auto-approved command execution in Roo Code
# Access settings and ensure auto-execute is disabled
# Or remove any commands from the auto-approved list
# Example: Clear auto-approved commands
roo-code config --auto-execute-commands ""