CVE-2025-53098: Roo Code arbitrary command execution via MCP configuration file writes

Summary

Roo Code, an AI-powered autonomous coding agent, stored project-specific MCP configuration in `.roo/mcp.json` within the VS Code workspace. Before version 3.20.3, an attacker who could submit prompts to the agent could have it write a malicious command into that file, leading to arbitrary command execution if the user had enabled auto-approved file writes.

Mitigation

Fixed in 3.20.3, which adds an additional opt-in configuration layer for auto-approving writes to Roo's configuration files, including all files within the `.roo/` folder.

Topics

• AI agents
• Model Context Protocol

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)