CVE-2025-58372: Roocode Roo Code RCE Vulnerability

CVE-2025-58372 Overview

CVE-2025-58372 is a critical Code Injection vulnerability affecting Roo Code, an AI-powered autonomous coding agent that operates within users' VS Code editors. The vulnerability exists because certain VS Code workspace configuration files (.code-workspace) are not protected in the same way as the .vscode folder. When the agent is configured to auto-approve file writes, an attacker capable of influencing prompts through prompt injection could cause malicious workspace settings or tasks to be written. These malicious tasks could then be executed automatically when the workspace is reopened, resulting in arbitrary code execution on the victim's system.

Critical Impact

This vulnerability allows attackers to achieve arbitrary code execution through prompt injection attacks against the AI coding agent, potentially compromising developer workstations and source code repositories.

Affected Products

• Roo Code versions 3.25.23 and below
• VS Code extensions utilizing Roo Code with auto-approve file write configurations
• Developer environments with unprotected .code-workspace files

Discovery Timeline

• September 5, 2025 - CVE CVE-2025-58372 published to NVD
• September 15, 2025 - Last updated in NVD database

Technical Details for CVE-2025-58372

Vulnerability Analysis

This vulnerability represents a significant security gap in how Roo Code handles workspace configuration files. While the .vscode folder receives protection to prevent unauthorized modifications, .code-workspace files were not included in this protected file list. This oversight creates an attack surface where prompt injection techniques can be leveraged to modify workspace configurations.

The attack chain involves an adversary influencing the AI agent's prompts to write malicious content to .code-workspace files. Since these files can contain task definitions and workspace settings that VS Code automatically processes, any malicious tasks embedded in these files execute when the workspace is subsequently opened. This transforms what appears to be a configuration file modification into a full arbitrary code execution vulnerability.

Root Cause

The root cause is an incomplete implementation of file protection mechanisms within Roo Code's RooProtectedController.ts component. The protected file patterns included .vscode/** directories and various configuration files but failed to include *.code-workspace files in the protection list. This CWE-94 (Improper Control of Generation of Code) vulnerability allowed the AI agent to write to these sensitive workspace files when auto-approve was enabled.

Attack Vector

The attack vector is network-based and requires no user interaction or privileges. An attacker must first establish the ability to influence the AI agent's prompts—for example, through malicious content in repositories, documentation, or other sources the agent processes. Once prompt injection is achieved, the attacker can instruct the agent to write malicious task configurations to .code-workspace files. The payload executes automatically when the developer reopens their workspace, requiring no additional interaction.

// Security patch from RooProtectedController.ts
// Source: https://github.com/RooCodeInc/Roo-Code/commit/296edfc829a7c6efc8b5dbe09aa766a9aed79598

 		".clinerules*",
 		".roo/**",
 		".vscode/**",
+		"*.code-workspace",
 		".rooprotected", // For future use
 		"AGENTS.md",
-		"AGENT.md", // Alternative singular form for compatibility
+		"AGENT.md",
 	]

 	constructor(cwd: string) {

The patch adds *.code-workspace to the list of protected file patterns, preventing the AI agent from writing to these files regardless of auto-approve settings.

Detection Methods for CVE-2025-58372

Indicators of Compromise

• Unexpected modifications to .code-workspace files in project repositories
• Presence of malicious task definitions within workspace configuration files
• Unusual VS Code task executions upon workspace opening
• Evidence of prompt injection attempts in AI agent logs or conversation history

Detection Strategies

• Monitor file system changes to .code-workspace files for unauthorized modifications
• Implement code review processes for workspace configuration file changes
• Audit AI agent activity logs for suspicious prompt patterns or file write operations
• Deploy endpoint detection rules to identify unexpected process spawning from VS Code task execution

Monitoring Recommendations

• Enable file integrity monitoring for workspace configuration files across development environments
• Configure SentinelOne to alert on suspicious VS Code child process activity
• Review and audit auto-approve settings in Roo Code configurations
• Implement repository scanning for malicious workspace configuration files in CI/CD pipelines

How to Mitigate CVE-2025-58372

Immediate Actions Required

• Upgrade Roo Code to version 3.26.0 or later immediately
• Disable auto-approve file write settings in Roo Code until the patch is applied
• Audit existing .code-workspace files for any suspicious or unexpected task definitions
• Review recent AI agent activity for potential prompt injection attempts

Patch Information

The vulnerability is fixed in Roo Code version 3.26.0. The patch adds *.code-workspace files to the protected file patterns in RooProtectedController.ts, preventing the AI agent from writing to these sensitive configuration files. Administrators should update all Roo Code installations via the VS Code extension marketplace. For detailed patch information, refer to the GitHub Security Advisory GHSA-4pqh-4ggm-jfmm and the GitHub Release v3.26.0.

Workarounds

• Disable auto-approve file write functionality in Roo Code settings until the update can be applied
• Manually add .code-workspace files to a custom .rooprotected configuration if supported
• Remove or rename existing .code-workspace files temporarily and recreate after patching
• Implement strict workspace trust settings in VS Code to prevent automatic task execution

# Configuration example - Check current Roo Code version
code --list-extensions --show-versions | grep -i roo

# Update Roo Code extension via command line
code --install-extension roocode.roo-code --force

# Verify workspace files for suspicious tasks (Linux/macOS)
find . -name "*.code-workspace" -exec grep -l "tasks" {} \;