CVE-2025-53536: Roo Code code execution via auto-approved Write to VS Code settings

Summary

CVE-2025-53536 affects Roo Code, an AI-powered autonomous coding agent, prior to 3.22.6. When the victim had "Write" auto-approved, an attacker able to submit prompts to the agent could write to VS Code settings files and trigger code execution. One example uses the php.validate.executablePath setting, where the attacker sets an arbitrary command as the PHP path and then creates a PHP file to trigger it.

Mitigation

Fixed in 3.22.6.

Topics

• AI agents

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)