CVE-2026-63108 Details

A command injection vulnerability has been identified in Roo Code versions through 3.54.0. This vulnerability resides in the auto-approve execute feature, allowing attackers to bypass allowlist and denylist enforcement by nesting command substitutions within parameter expansion defaults. The issue arises because the command parser replaces parameter expansions with opaque placeholders before extracting command substitutions. This sequence causes the 'containsDangerousSubstitution' guard to overlook nested payloads, which are then auto-approved based on the outer allowlisted command prefix. The approved commands are executed by the shell via 'execa', enabling arbitrary command execution on the developer's machine within the agent's auto-run privileges.

To address this vulnerability, extract and validate command substitutions before replacing parameter expansions with placeholders. Additionally, recurse into the contents of parameter expansions to check for nested command substitutions. Alternatively, the 'containsDangerousSubstitution' guard can be extended to flag any command substitution or backtick usage within a parameter expansion, ensuring that such commands are denied execution.