Auto-Approve Bypass Vulnerability in Roo-Code by 7rah

CVE-2026-82536

What is CVE-2026-82536?

Roo-Code version 3.54.0 is affected by an auto-approve bypass vulnerability in its shell command parsing logic. This flaw allows malicious actors to exploit the omission of the bash pipe operator in the command parser's token set. By crafting specific command lines that include an allowlisted prefix, attackers can insert a stderr-redirecting pipe operator followed by a prohibited command. Consequently, the command parser erroneously approves the entire command pipeline, enabling the bash interpreter to execute the denied command with elevated privileges on the developer's machine.

References