A high-severity command injection vulnerability in Roo-Code allows remote attackers to execute arbitrary commands by leveraging improper input validation.

The vulnerability stems from an incomplete list of disallowed inputs (CWE-184), allowing an attacker to bypass security filters and perform command injection through parameter expansion. This vulnerability is reachable over the network and requires user interaction.

This vulnerability carries a CVSS score of 8.8, reflecting the high potential for total system compromise if an attacker successfully injects and executes arbitrary commands. Such an outcome could lead to complete loss of confidentiality and integrity of the development environment or server hosting the Roo-Code instance.

Immediate Action: Apply the latest security updates provided by the vendor immediately to resolve the input validation deficiency.

Proactive Monitoring: Monitor system and application logs for unusual command execution patterns or attempts to pass unexpected parameters to the application.

Compensating Controls: Deploy a Web Application Firewall or similar filtering mechanism to inspect incoming requests for malicious payloads that attempt to exploit parameter expansion flaws.

Public Exploit Available: Unknown

Due to the existence of a proof-of-concept, the risk of exploitation is elevated. Organizations should prioritize updating their Roo-Code installations to the latest version to prevent potential command injection attacks.