A critical command injection vulnerability in Roo-Code allows local attackers with low privileges to execute arbitrary commands by smuggling malicious payloads through multi-line inputs.

The application fails to validate newline characters within command inputs, leading to a bypass of security allow-lists. This flaw allows a local, authenticated attacker to inject and execute unauthorized commands by appending them to legitimate command strings.

The vulnerability carries a CVSS score of 7.8, reflecting a high risk to system integrity and confidentiality. Successful exploitation grants an attacker the ability to execute arbitrary code with the privileges of the AI agent, potentially leading to unauthorized data access, system compromise, or the installation of persistent malicious tools within the development environment.

Immediate Action: Update Roo-Code to version 3.23.19 or later immediately to implement proper input validation and line-break sanitization.

Proactive Monitoring: Review system logs for unusual command execution patterns or unauthorized shell invocations originating from the Roo-Code process.

Compensating Controls: Restrict local user access to the environment where the AI agent operates and enforce the principle of least privilege to limit the potential impact of arbitrary code execution.

Public Exploit Available: Unknown.

Given the severity of this command injection vulnerability and the existence of proof-of-concept evidence, organizations must prioritize patching Roo-Code to version 3.23.19. Failure to remediate this flaw exposes development environments to significant risk of unauthorized code execution and potential lateral movement. Apply the update immediately to ensure the integrity of the development workflow.