{"data":{"id":"33bf8dd7-998d-43e7-9103-745754973a29","title":"CVE-2025-65946: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an…","summary":"CVE-2025-65946 affects Roo Code, an AI-powered autonomous coding agent that runs in users' editors, in versions prior to 3.26.7. A validation error let Roo automatically execute commands that did not match the allow list prefixes. The issue is classified as CWE-77 (Command Injection) and CWE-20 (Improper Input Validation).","solution":"This issue has been patched in version 3.26.7.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-65946","publishedAt":"2025-11-21T23:15:45.170Z","cveId":"CVE-2025-65946","cweIds":["CWE-20","CWE-77","CWE-77"],"cvssScore":"8.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Roo Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Roo Code auto-executes commands outside its allow list prefixes","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00707,"epssCheckedAt":"2026-11-04T06:10:13.820Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T06:10:29.980Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}