What happened
VulnCheck published a cluster of Roo Code command-approval bypass CVEs (e.g., CVE-2026-110202 CVSS 8.8) on 2026-10-13. Each is a distinct flaw in getCommandDecision()/parseCommandLine(): the permission gate classifies only part of a shell command line, so approved prefixes like "echo " mask a denied command appended via redirects, quote masking, ${...} substitution, glob-adjacent command substitution, or command-position substitution. The affected parser then auto-approves the outer match while the shell runs the hidden payload. Verified via NVD REST API (published 2026-10-13, CVSS 8.8 v3.1, CWE-436).
Why it matters
This is a new agent-execution attack class in the lineage of the established bash-permission-bypass research: an AI coding agent with any tool that can run shell commands becomes a remote-controlled command executor when it ingests untrusted text. For an AI/security team, an attacker who can plant content the agent reads can silently steal credentials, clone repos, or pivot from the laptop — reaching the same class of agent-trust failure that has produced KEV-listed and widely exploited coding-agent flaws. The multi-CVE cluster shows the parser is systemically weak against shell metacharacter edge cases.
Attack vector
Indirect prompt injection: malicious content in a repo file, fetched page, or tool output instructs the agent to run a shell command. The attacker shapes the command (bare >& redirect prefix, quote-masked separators, ${...} substitutions, glob-adjacent $(), or command-position $()) so the allowlist/permission parser auto-approves it while the shell executes the denied payload on the developer's machine.
Affected systems
Roo Code (VS Code AI coding agent) through 3.54.0; sibling IDs CVE-2026-110203/110204/110205/110206 and related parseCommandLine bypasses
Mitigation
Update Roo Code past 3.54.0; no fixed release stated in the window. Until patched, do not run the agent against untrusted repos, disable auto-approve of shell commands, and treat workspace/fetched content as untrusted.