A critical auto-approve bypass vulnerability in Roo-Code allows attackers to execute unauthorized shell commands, potentially leading to full system compromise on developer machines.

The vulnerability exists in the shell command parsing logic within the parseCommand function, which fails to recognize the |& bash pipe operator. This omission allows an attacker to craft a command string that hides a denied command behind an allowlisted prefix, causing the parser to incorrectly approve the entire pipeline for execution.

Successful exploitation allows an attacker to bypass security allowlists and execute arbitrary commands with the privileges of the developer's agent. This could lead to unauthorized data access, local file modification, or the installation of malicious software on the host development environment. Given the CVSS score of 8.8, this flaw represents a significant risk to the integrity and security of the local development infrastructure.

Immediate Action: Update Roo-Code to a version beyond 3.54.0 that implements a complete list of bash operators, including |&, in the command parsing logic. If an update is not immediately available, disable the "always approve execute" feature to force manual review of all commands.

Proactive Monitoring: Review audit logs for unusual shell command patterns, specifically those containing the |& operator, and investigate any unexpected file system modifications originating from the Roo-Code process.

Compensating Controls: Restrict the agent's execution privileges to the minimum required level and utilize host-based security tools to monitor for unauthorized execution of sensitive binaries or unexpected child processes.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's technical write-up referenced in the CVE record.

The risk associated with this vulnerability is high due to its ability to bypass security controls and execute arbitrary commands. Organizations utilizing Roo-Code must prioritize the transition to a patched version immediately. Until an update is applied, users should disable automated execution features to prevent potential exploitation via indirect prompt injection or malicious repository content.