CVE-2026-81837

Name of the Vulnerable Software and Affected Versions RooCodeInc Roo-Code versions prior to 3.51.2

Description A path traversal flaw exists in the ApplyPatchTool component within the file src/core/tools/ApplyPatchTool.ts. The issue resides in the path.resolve() function, which allows a remote attacker to perform path traversal. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly neutralized.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.