CVE-2026-82537: Roo-Code Auto-Approve Bypass Vulnerability

CVE-2026-82537 Overview

CVE-2026-82537 is an auto-approve bypass vulnerability in Roo-Code through version 3.54.0. The flaw stems from a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string where an allowlisted word is immediately followed by a hash character, a separator, and a denied command. The approval gate treats the trailing content as a comment and allows execution, while bash interprets and executes the denied command with the agent's auto-execute privileges on the developer's machine. This vulnerability is classified under [CWE-436] Interpretation Conflict.

Critical Impact
Attackers can execute arbitrary shell commands under the AI coding agent's auto-execute privileges, bypassing the user-defined denylist and gaining code execution on the developer's workstation.

Affected Products

Roo-Code versions through 3.54.0
Deployments relying on the auto-approve command allowlist/denylist gate
Developer workstations running the affected Roo-Code agent extension

Discovery Timeline

2026-09-08 - CVE-2026-82537 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82537

Vulnerability Analysis

Roo-Code enforces an auto-approve policy by parsing proposed shell commands and checking tokens against an allowlist and denylist. The approval gate and bash disagree on where a shell comment begins. The gate's parser treats a # character as starting a comment based on its own word-boundary rules, while bash requires # to appear at the start of a word (preceded by whitespace or a command separator) to be interpreted as a comment.

When an attacker crafts input such as an allowlisted token concatenated directly with #, a separator, and a denied command, the approval gate strips the trailing portion as a comment and approves the residual allowlisted command. Bash then evaluates the full string, does not treat the # as beginning a comment, and executes the denied command through the separator. The result is silent execution of blocked commands under the agent's identity.

Root Cause

The root cause is an interpretation conflict [CWE-436] between two shell parsers operating on the same input. The security decision is made by one parser and the execution is performed by another, and their tokenization rules differ. Any divergence in comment handling, quoting, or word boundaries between the gate and the executing shell can be leveraged to smuggle commands past the policy.

Attack Vector

Exploitation requires attacker-controlled input to be proposed as a shell command to the Roo-Code agent, for example through prompt injection, malicious repository content, untrusted issue text, or a compromised model context. The agent submits the crafted command; the approval gate matches the leading allowlisted portion and treats everything after # as a comment. Bash executes the entire string, including the command after the separator, with the developer's local privileges. See the VulnCheck Security Advisory and the GitHub CVE Documentation for the full technical walkthrough and payload construction.

// Example exploitation pattern (conceptual, sanitized)
// Allowlisted token immediately followed by '#', a separator, then a denied command.
// The approval gate treats content after '#' as a comment and approves.
// bash does not recognize '#' as a comment (no preceding whitespace) and executes the full line.
<allowlisted-token>#;<denied-command>

Detection Methods for CVE-2026-82537

Indicators of Compromise

Shell history entries containing an allowlisted command token followed directly by # and a command separator such as ;, &&, ||, or a newline.
Execution of denylisted binaries (for example, curl, wget, nc, bash -c, sh -c) initiated by the Roo-Code agent process tree.
Unexpected outbound network connections or file writes from the developer's IDE or Roo-Code helper processes.

Detection Strategies

Audit shell command logs for tokens matching the pattern \w+#[;&|] or \w+#\s*\n originating from the agent.
Correlate parent process lineage: flag child shells spawned by Roo-Code that execute commands not present in the approved allowlist.
Compare the command string presented to the approval gate against the string actually executed by bash; alert on divergence.

Monitoring Recommendations

Enable verbose logging in Roo-Code for every auto-approved command and store the raw payload for review.
Monitor developer workstations for anomalous process creation from IDE-adjacent processes using endpoint telemetry.
Track outbound connections from developer machines to non-corporate destinations initiated shortly after AI coding sessions.

How to Mitigate CVE-2026-82537

Immediate Actions Required

Upgrade Roo-Code beyond version 3.54.0 as soon as a fixed release is available from the maintainers.
Disable auto-approve for shell command execution and require explicit user confirmation for every command.
Review recent agent-executed command history for evidence of bypass payloads containing # followed by separators.

Patch Information

Refer to the VulnCheck Security Advisory and the GitHub CVE Documentation for the authoritative fix status and upgrade guidance. Users should apply the vendor patch that aligns the approval gate's parser semantics with bash and rejects commands containing embedded # sequences adjacent to separators.

Workarounds

Turn off the auto-approve feature and require manual approval for every shell command proposed by the agent.
Restrict the allowlist to a minimal set of commands and reject any proposed command containing #, ;, &&, ||, or backticks.
Run the Roo-Code agent inside a sandbox, container, or unprivileged user account with no access to sensitive credentials or source repositories.
Apply prompt-injection defenses at the model input layer to reduce attacker control over proposed commands.

bash

# Configuration example: reject commands containing shell metacharacters before submission
case "$PROPOSED_CMD" in
  *\#*|*\;*|*\&\&*|*\|\|*|*\`*)
    echo "Rejected: potentially unsafe metacharacter in command" >&2
    exit 1
    ;;
esac