CVE-2026-81837 Overview
CVE-2026-81837 is a path traversal vulnerability [CWE-22] affecting RooCodeInc Roo-Code versions up to 3.51.1. The flaw resides in the path.resolve function within src/core/tools/ApplyPatchTool.ts, part of the ApplyPatchTool component. Attackers can manipulate input to traverse directory boundaries and access files outside intended paths. The attack can be initiated remotely and requires user interaction. A public proof-of-concept exploit exists. The vendor has archived the Roo-Code repository and stated the project is no longer supported. This vulnerability only affects unsupported product versions, and the maintainer discourages continued use of the codebase.
Critical Impact
Remote path traversal permits attackers to read or write files outside the intended directory scope through the ApplyPatchTool, with no vendor patch available due to project abandonment.
Affected Products
- RooCodeInc Roo-Code versions up to and including 3.51.1
- Component: ApplyPatchTool (src/core/tools/ApplyPatchTool.ts)
- Function: path.resolve
Discovery Timeline
- 2026-08-28 - CVE-2026-81837 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-81837
Vulnerability Analysis
The vulnerability exists in Roo-Code's ApplyPatchTool component, which handles patch application operations. The path.resolve call within src/core/tools/ApplyPatchTool.ts fails to validate or sanitize user-controlled path segments before resolving file locations. This allows attackers to inject traversal sequences such as ../ to escape the intended working directory. The result is unauthorized read or write access to files elsewhere on the filesystem. A public proof-of-concept has been published on GitHub Gist, increasing the likelihood of opportunistic exploitation attempts.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Node.js path.resolve normalizes traversal sequences but does not confine the result to an allowed base directory. Without an explicit containment check comparing the resolved path against the intended root, patch operations can target arbitrary filesystem locations. The ApplyPatchTool accepts path input from patch payloads and passes it directly to filesystem operations.
Attack Vector
Exploitation requires network access and user interaction, consistent with the delivery model of an AI coding assistant that processes patch instructions. An attacker crafts a malicious patch containing relative traversal sequences in the target path field. When a user applies the patch through Roo-Code, ApplyPatchTool resolves the path outside the workspace and performs the file operation. See the GitHub Gist PoC and the VulDB CVE-2026-81837 entry for technical details. No verified code samples are reproduced here.
Detection Methods for CVE-2026-81837
Indicators of Compromise
- Patch payloads containing ../ or absolute path prefixes in target file fields processed by ApplyPatchTool
- Roo-Code file write operations targeting paths outside the active workspace directory
- Unexpected modifications to system configuration files, SSH keys, or shell startup scripts on developer workstations running Roo-Code
Detection Strategies
- Instrument endpoint telemetry to flag file writes by the Roo-Code process outside its workspace root
- Review Roo-Code logs for ApplyPatchTool invocations with suspicious relative or absolute path arguments
- Perform static analysis on installed Roo-Code versions to confirm the presence of the vulnerable path.resolve call without a containment check
Monitoring Recommendations
- Track file integrity on developer workstation locations frequently targeted by traversal attacks, including ~/.ssh, ~/.aws, and shell profile files
- Alert on process creation chains where the Roo-Code binary or extension host writes to paths outside expected project directories
- Correlate patch-application events with subsequent file modifications to detect escaped writes
How to Mitigate CVE-2026-81837
Immediate Actions Required
- Uninstall or disable Roo-Code on all developer systems, since the project is archived and unsupported by the maintainer
- Migrate to an actively maintained AI coding assistant with documented path-handling controls
- Audit workstations that previously ran Roo-Code for unexpected file modifications outside project directories
Patch Information
No official patch is available. The maintainer has archived the Roo-Code repository and stated the project is no longer supported. Users are discouraged from continued use. Reference the VulDB advisory for the vendor's public statement.
Workarounds
- Remove the Roo-Code extension or CLI from all endpoints as the definitive mitigation
- If temporary continued use is unavoidable, restrict Roo-Code to sandboxed environments or containers with read-only mounts outside the active project
- Apply operating system access controls to prevent the Roo-Code process from writing to sensitive locations such as ~/.ssh, ~/.aws, and system directories
- Review and reject any patches received from untrusted sources before applying them through ApplyPatchTool
# Configuration example: remove Roo-Code and verify
npm uninstall -g roo-code 2>/dev/null || true
code --uninstall-extension RooCodeInc.roo-code 2>/dev/null || true
find ~ -type d -name "roo-code" 2>/dev/null
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
