CVE-2025-53097: Roo Code search_files tool reads files outside VS Code workspace

Summary

Roo Code, an AI-powered autonomous coding agent, prior to version 3.20.3 had a flaw where the `search_files` tool ignored the setting that disables reads outside the VS Code workspace. An attacker who could inject a prompt into the agent could read a sensitive file and write its contents into a JSON schema, which triggered a network request by default without user confirmation. The issue is rated moderate because the attacker must already be able to submit prompts to the agent.

Mitigation

Fixed in 3.20.3: `search_files` now respects the setting that limits it to the workspace.

Topics

• AI agents

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)