{"data":{"id":"05583d44-490b-4599-b5d7-c73c6a6f4f7a","title":"CVE-2025-54377: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode…","summary":"Roo Code, an AI-powered autonomous coding agent for editors, versions 3.23.18 and below, does not validate line breaks (\\n) in its command input. This allows a bypass of the allow-list mechanism, since only the first line or token may be considered when commands are evaluated, so additional commands in subsequent lines can run.","solution":"Fixed in version 3.23.19.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-54377","publishedAt":"2025-07-23T21:15:27.060Z","cveId":"CVE-2025-54377","cweIds":["CWE-77"],"cvssScore":"7.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Roo Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Roo Code allow-list bypass via multi-line command injection","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01126,"epssCheckedAt":"2026-11-04T18:09:13.251Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T18:09:33.174Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}