{"data":{"id":"1d9ba785-2b1f-482d-9c94-7134627c393b","title":"CVE-2025-58373: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a…","summary":"Roo Code versions 3.25.23 and below contain a flaw where .rooignore exclusions can be bypassed using symlinks. An attacker with write access to the workspace can trick the extension into reading files meant to be excluded, such as .env or configuration files, exposing secrets and other excluded project data.","solution":"Fixed in version 3.26.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-58373","publishedAt":"2025-09-05T23:15:30.830Z","cveId":"CVE-2025-58373","cweIds":["CWE-59"],"cvssScore":"5.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Roo Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Roo Code .rooignore bypass via symlinks exposes excluded files","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00317,"epssCheckedAt":"2026-11-04T18:09:14.876Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T12:08:51.324Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}