AI agents

Roo Code versions 3.25.23 and below ship a default allowlist of commands that run without manual approval when auto-approve is enabled, and that list includes npm install. Because npm install executes lifecycle scripts, a malicious postinstall script in a repository's package.json runs automatically, so opening a malicious repo with auto-approved commands enabled can lead to arbitrary code execution.

Roo Code, an AI-powered autonomous coding agent for editors, versions 3.25.23 and below, does not protect VS Code .code-workspace files the way it protects the .vscode folder. If the agent auto-approves file writes, an attacker who can influence its prompts, for example through prompt injection, can have malicious workspace settings or tasks written. Those tasks run automatically when the workspace is reopened, leading to arbitrary code execution.

CVE-2025-58370 affects Roo Code, an AI-powered autonomous coding agent, in versions below 3.26.0. The command parsing logic mishandles Bash parameter expansion and indirect references, so when the agent is configured to auto-approve certain commands, an attacker who can influence prompts can get additional arbitrary commands executed alongside the intended one. The weakness is classified as CWE-78, OS Command Injection.

CVE-2025-57771 affects Roo Code, an AI-powered autonomous coding agent, in versions prior to 3.25.5. The command parsing logic does not properly handle process substitution and single ampersand characters for auto-execute commands, so an attacker who can submit crafted prompts may inject arbitrary commands to run alongside an intended command such as ls. Exploitation requires prompt submission access and that the user has enabled auto-approved command execution, which is disabled by default; the source states this could allow arbitrary code execution.

Claude Code versions prior to 1.0.4 contain an overly broad allowlist of safe commands. This lets an attacker bypass confirmation prompts to read a file and send its contents over the network without user approval. Reliable exploitation requires the ability to insert untrusted content into a Claude Code context window.

Prior to version 0.197.3 of Zed, a multiplayer code editor, the Zed Agent Panel let an AI agent bypass user permission checks. By exploiting this, an agent could create or modify a project-specific configuration file and execute arbitrary commands on a victim's machine without the explicit approval normally required, achieving Remote Code Execution (RCE).

Roo Code, an AI-powered autonomous coding agent for editors, versions 3.23.18 and below, does not validate line breaks (\n) in its command input. This allows a bypass of the allow-list mechanism, since only the first line or token may be considered when commands are evaluated, so additional commands in subsequent lines can run.

CVE-2025-53536 affects Roo Code, an AI-powered autonomous coding agent, prior to 3.22.6. When the victim had "Write" auto-approved, an attacker able to submit prompts to the agent could write to VS Code settings files and trigger code execution. One example uses the php.validate.executablePath setting, where the attacker sets an arbitrary command as the PHP path and then creates a PHP file to trigger it.

Roo Code, an AI-powered autonomous coding agent, stored project-specific MCP configuration in `.roo/mcp.json` within the VS Code workspace. Before version 3.20.3, an attacker who could submit prompts to the agent could have it write a malicious command into that file, leading to arbitrary command execution if the user had enabled auto-approved file writes.

CVE-2025-52882 affects Claude Code extensions for VSCode and its forks, such as Cursor, Windsurf, and VSCodium, as well as the JetBrains plugin Claude Code [Beta]. Visiting attacker-controlled webpages lets an attacker make unauthorized websocket connections to the IDE. Exploitation can read arbitrary files, list open files, and obtain selection and diagnostics events, and in VSCode it can also execute code in limited cases involving an open Jupyter Notebook and an accepted malicious prompt.

The source text is NIST NVD navigation material: a disclaimer about external links and a list of GitHub commit and advisory URLs for CVE-2025-48491 in the Project AI platform for creating AI agents. It does not describe the flaw, the affected versions or the impact, beyond the title's note that before the pre-beta version a hardcoded API key was present.