CVE-2025-58373: Roo Code Information Disclosure Vulnerability

CVE-2025-58373 Overview

Roo Code is an AI-powered autonomous coding agent that runs inside a developer's editor. Versions 3.25.23 and below contain a symlink-based bypass of the extension's .rooignore protections. An attacker with write access to the workspace can create symbolic links that point at files intended to be excluded, tricking the extension into reading them. Sensitive artifacts such as .env files and configuration files can be exposed through this path. The issue is tracked under [CWE-59] (Improper Link Resolution Before File Access) and is fixed in version 3.26.0.

Critical Impact
An attacker who can modify workspace files bypasses .rooignore exclusions and gains unauthorized read access to secrets and configuration data.

Affected Products

Roo Code extension versions <= 3.25.23
Roocode roo_code package distributed through editor marketplaces
Any workspace where an attacker has write access and the vulnerable version is installed

Discovery Timeline

2025-09-05 - CVE-2025-58373 published to NVD
v3.26.0 - Vendor releases patched build via GitHub Release v3.26.0
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58373

Vulnerability Analysis

Roo Code enforces file exclusions through a .rooignore file, similar in intent to .gitignore. The extension consults this list before reading workspace files into the AI agent's context. In vulnerable versions, the check operates on the requested path string rather than the resolved filesystem target. When the extension encounters a symbolic link, it follows the link and reads the underlying file without re-evaluating the target against .rooignore rules.

This breaks the trust boundary between the AI agent and sensitive project data. Files such as .env, cloud credentials, private keys, and configuration files that developers explicitly excluded become reachable. The AI agent then processes their contents, which may be surfaced back to the user, transmitted to model providers, or referenced in generated code.

Root Cause

The root cause is improper link resolution before file access [CWE-59]. The exclusion check compares path names, not canonical filesystem targets. See the fix in GitHub Pull Request #7405 for the corrected resolution logic.

Attack Vector

Exploitation requires an attacker with write access to the workspace, for example through a malicious dependency, a compromised branch, a pull request, or a shared development environment. The attacker creates a symlink inside a non-ignored directory that points to an excluded file such as .env. When a developer invokes Roo Code and the agent reads the symlink path, the extension returns the contents of the target file. The GitHub Security Advisory GHSA-p76r-7mc3-qh7c documents the vector and impact.

Detection Methods for CVE-2025-58373

Indicators of Compromise

Symbolic links inside tracked source directories whose targets resolve to .env, .aws/credentials, id_rsa, or other files listed in .rooignore
Recent commits or pull requests that introduce symlinks pointing outside the repository root or into ignored paths
Roo Code activity logs referencing file reads that match .rooignore patterns

Detection Strategies

Scan repositories for symlinks using find . -type l and validate that targets are not covered by ignore rules
Add pre-commit or CI checks that reject symlinks resolving to sensitive filenames or paths outside the workspace
Review editor extension telemetry for file access events that correlate with newly added links

Monitoring Recommendations

Monitor version control history for symlink additions in pull requests from untrusted contributors
Alert on developer workstations where Roo Code versions <= 3.25.23 remain installed
Track outbound requests from developer machines to AI model endpoints that include content originating from ignored files

How to Mitigate CVE-2025-58373

Immediate Actions Required

Upgrade Roo Code to version 3.26.0 or later on every developer workstation
Audit workspaces for unauthorized symlinks pointing at secrets or configuration files and remove them
Rotate any credentials stored in .env or configuration files that may have been read by the agent

Patch Information

The vulnerability is fixed in Roo Code 3.26.0. The patch resolves symlinks to their canonical targets before evaluating .rooignore rules, ensuring that excluded files remain inaccessible regardless of the requested path. Release notes and the corresponding code change are available in GitHub Release v3.26.0 and GitHub Pull Request #7405.

Workarounds

Restrict write access to shared workspaces and require code review for pull requests that introduce symlinks
Store secrets outside the workspace directory, for example in a system keychain or secret manager, so that symlink traversal cannot reach them
Disable the Roo Code extension in repositories that must remain on a vulnerable version until upgrade is possible

bash

# Identify symlinks in a workspace that may bypass .rooignore
find . -type l -exec ls -l {} \; \
  | awk '{print $NF, "<-", $(NF-2)}'

# Upgrade Roo Code from the VS Code CLI
code --install-extension RooVeterinaryInc.roo-cline --force