CVE-2026-63108 Overview
CVE-2026-63108 is a command injection vulnerability in Roo Code through version 3.54.0. The flaw exists in the auto-approve execute feature and allows attackers to bypass allowlist and denylist enforcement. Attackers nest command substitutions inside parameter expansion defaults to evade the containsDangerousSubstitution guard. The command parser in parse-command.ts replaces parameter expansions with opaque placeholders before extracting command substitutions. This ordering causes nested payloads to escape inspection. Roo Code then auto-approves the outer allowlisted command prefix and executes the full string through execa, resulting in arbitrary command execution on the host.
Critical Impact
Attackers can achieve arbitrary command execution on developer systems by inducing Roo Code to auto-approve crafted shell commands that appear to match allowlisted prefixes.
Affected Products
- Roo Code versions through 3.54.0
- The parse-command.ts command parser component
- Environments using the auto-approve execute feature with allowlist enforcement
Discovery Timeline
- 2026-07-20 - CVE-2026-63108 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-63108
Vulnerability Analysis
The vulnerability categorizes as Command Injection and maps to [CWE-184] Incomplete List of Disallowed Inputs. Roo Code implements an auto-approve execute feature that inspects shell commands against an allowlist and denylist before invocation. The parser processes shell metacharacters in the wrong order, creating a bypass condition. Because the outer command prefix matches an allowed entry, the auto-approve logic hands the full command string to execa for execution. The user receives no additional confirmation prompt for the nested payload.
Root Cause
The root cause lies in the parsing order within parse-command.ts. The parser substitutes parameter expansions such as ${VAR:-default} with opaque placeholders before it scans for command substitutions using $(...) or backtick syntax. When a command substitution is nested inside the default value of a parameter expansion, the placeholder replacement hides it from the containsDangerousSubstitution guard. The guard therefore reports the command as safe, and the outer allowlisted prefix satisfies the auto-approve check.
Attack Vector
Exploitation requires user interaction and network delivery of a crafted prompt or task input to a Roo Code instance. An attacker supplies a command that begins with an allowlisted prefix, then embeds a payload inside a parameter expansion default such as ${x:-$(malicious)}. The parser strips the parameter expansion, misses the nested substitution, and forwards the string to execa. The shell then evaluates the nested command substitution during execution, running attacker-controlled code with the privileges of the Roo Code process. The EPSS probability for CVE-2026-63108 is approximately 1.92 percent.
See the VulnCheck advisory on Roo Code and the Roo-Code technical writeup for full exploitation details.
Detection Methods for CVE-2026-63108
Indicators of Compromise
- Shell command strings containing parameter expansion syntax with nested command substitutions, such as ${var:-$(...)} or ${var:-...}.
- Unexpected child processes spawned by the Roo Code process or its execa invocations.
- Auto-approved commands in Roo Code logs that use allowlisted prefixes followed by parameter expansion defaults.
Detection Strategies
- Inspect Roo Code task history and command execution logs for commands containing ${ sequences paired with $( or backtick characters.
- Monitor process creation telemetry on developer workstations for shell processes descended from the Roo Code editor or extension host.
- Correlate outbound network connections from developer endpoints with Roo Code execution events to identify unexpected data egress.
Monitoring Recommendations
- Enable verbose command logging in Roo Code and forward logs to a centralized analytics platform for pattern review.
- Alert on any execution of downloader utilities such as curl, wget, or powershell originating from Roo Code sessions.
- Track modifications to Roo Code configuration files that adjust allowlist or auto-approve settings.
How to Mitigate CVE-2026-63108
Immediate Actions Required
- Upgrade Roo Code to a release later than 3.54.0 that includes the parser fix once the vendor publishes it.
- Disable the auto-approve execute feature until the patched version is deployed.
- Review and tighten allowlist entries to remove command prefixes that accept arbitrary arguments.
Patch Information
Refer to the VulnCheck advisory and the upstream Roo Code repository for the fixed release version and commit references. Apply the vendor patch to all developer workstations and CI environments running Roo Code.
Workarounds
- Turn off auto-approve for shell command execution and require manual confirmation for every command.
- Run Roo Code inside a container or sandbox with restricted filesystem and network access.
- Add denylist rules that reject any command containing ${ combined with $( or backtick characters until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
