Symlink Bypass in Roo Code – AI-Powered Coding Agent

CVE-2025-58373

What is CVE-2025-58373?

Roo Code, an AI-powered autonomous coding agent integrated with user editors, has a vulnerability found in versions 3.25.23 and earlier. This security flaw allows an attacker with write permissions to exploit symlinks, bypassing the .rooignore file protections. Consequently, sensitive files such as .env or other critical configuration files, which should remain undisclosed, can be exposed. Attackers may gain unauthorized access to essential project data by manipulating files within the workspace. The issue has been addressed in version 3.26.0, emphasizing the importance of updating to remain secure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References