Minqiang Gui

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line with an allowlisted prefix followed by the stderr-redirecting pipe operator and a denied command, causing the parser to approve the full pipeline while bash executes the denied component with the agent's auto-execute privileges on the developer's machine.

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word immediately followed by a hash character, separator, and denied command to pass the approval gate while bash executes the denied command with the agent's auto-execute privileges on the developer's machine.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 15.6 macOS versions prior to 14.7.7 macOS versions prior to 13.7.7 **Description** An issue with access restrictions was addressed through enhanced sandbox limitations. An application may potentially gain unauthorized access to the Local Network. **Recommendations** Update to macOS version 15.6 or later. Update to macOS version 14.7.7 or later. Update to macOS version 13.7.7 or later.