CVE-2025-57771: Roo Code command injection in auto-approved command parsing

Summary

CVE-2025-57771 affects Roo Code, an AI-powered autonomous coding agent, in versions prior to 3.25.5. The command parsing logic does not properly handle process substitution and single ampersand characters for auto-execute commands, so an attacker who can submit crafted prompts may inject arbitrary commands to run alongside an intended command such as ls. Exploitation requires prompt submission access and that the user has enabled auto-approved command execution, which is disabled by default; the source states this could allow arbitrary code execution.

Mitigation

Fixed in version 3.25.5.

Topics

• AI agents

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)