Loading story…
Roo Code through version 3.54.0 is affected by high-severity vulnerability CVE-2026-63108 that allows arbitrary command execution through its auto-approve execute feature. The flaw stems from parsing logic in parse-command.ts that replaces Bash parameter expansions such as ${...} with placeholders before checking for command substitutions like $() and backticks, letting nested subshell payloads evade the containsDangerousSubstitution safeguard. Because approval decisions rely on the outer command string, an attacker can hide a malicious command inside a parameter-expansion default while preserving an allowlisted prefix.
Researchers said the issue affects code paths including parseCommand and getCommandDecision, with the final command executed by a shell via execa, which performs the hidden expansion at runtime. A demonstrated example showed an apparently benign command such as:
echo ${x:-$(touch /tmp/ROO_PWNED)}
being auto-approved when "always approve execute" is enabled, despite containing a denied nested command. The reports warn that indirect prompt injection could plausibly trigger the behavior by steering an agent to emit a seemingly safe command, and they recommend upgrading to a fixed/latest version, failing closed on $( or backticks inside ${...}, strengthening validation and sanitization, and adding regression tests.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
An advisory disclosed CVE-2026-63108, a high-severity command injection vulnerability affecting Roo Code through version 3.54.0. The issue allows nested command substitutions inside parameter expansion defaults to bypass approval checks and reach shell execution via execa, with guidance to update to a fixed/latest version.
A report described a bypass in Roo Code's auto-approval safety control for shell command execution, where command substitution nested inside Bash parameter expansion could evade allowlist and denylist checks. The report identified affected logic in parseCommand and getCommandDecision and recommended mitigations and regression tests.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity command injection vulnerabilities have been disclosed in developer tooling and automation software, enabling arbitrary command execution through improperly sanitized shell inputs. `CVE-2026-32917` affects OpenClaw versions earlier than `2026.3.13`, where the iMessage attachment staging workflow passes unsanitized remote attachment paths directly into an SCP remote operand. If remote attachment staging is enabled, an unauthenticated attacker can use shell metacharacters in attachment paths to execute commands on configured remote hosts; the flaw is tracked as `CWE-78` and carries a CVSS v3.1 rating of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. A separate issue, `CVE-2026-35020`, impacts Anthropic Claude Code CLI and the Claude Agent SDK, where attacker-controlled input from the `TERMINAL` environment variable can reach `/bin/sh` with `shell=true` through the command lookup helper and deep-link terminal launcher. A local attacker can exploit the bug during normal CLI use or via the deep-link handler to run arbitrary commands with the privileges of the invoking user. Both disclosures highlight continued risk from unsanitized shell metacharacters in application workflows, with OpenClaw publishing a fixing commit and security advisory alongside third-party vulnerability reporting.
Jun 29, 2026
Researchers at Adversa AI disclosed **GuardFall**, a shell-interpretation bypass that affects 10 of 11 surveyed open-source AI coding and computer-use agents, allowing malicious commands to slip past safety filters. The flaw stems from agents checking raw command text while `bash` later rewrites and evaluates that text through expansion, substitution, and quote handling, enabling decades-old evasion techniques such as quoted token splitting, `$IFS` expansion, command substitution, and encoded pipelines. Adversa reported successful end-to-end exploitation against the production **Plandex** binary and said vulnerable agents include **Hermes, opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, and SWE-agent**, while **Continue** was the only surveyed tool found to substantially mitigate the issue through structural command parsing and recursive analysis. The attack becomes especially dangerous when an agent is induced by untrusted content—such as poisoned **READMEs, Makefiles, MCP server responses, package metadata, or repository configuration files**—to emit commands that are then auto-executed on the user’s host. Adversa warned that successful exploitation could expose **SSH keys, cloud credentials, and files in `$HOME`**, and noted that sandbox protections can disappear when agents are run in documented local-host modes. No public in-the-wild exploitation was reported, but researchers urged users to disable auto-execute features, isolate or redirect `$HOME`, avoid running agents on forked pull requests, audit repository-shipped configs, and adopt tokenize-and-canonicalize command enforcement instead of regex or raw-string blocklists.
Jul 12, 2026
Security researchers disclosed two high-severity vulnerabilities in the open-source **OpenCode** AI coding agent that can allow **arbitrary command execution on a developer workstation** in drive-by scenarios. **CVE-2026-22812** stems from OpenCode automatically starting an **unauthenticated HTTP server** with **permissive CORS** (`Access-Control-Allow-Origin: *`), enabling any local process—or a malicious website via cross-origin requests—to invoke sensitive local API endpoints and execute shell commands with the user’s privileges. Separately, **CVE-2026-22813** is a **critical** issue in the OpenCode web UI where the markdown renderer can inject arbitrary HTML into the DOM without sanitization (no *DOMPurify* and no CSP), enabling JavaScript execution on the `http://localhost:4096` origin and subsequent access to local APIs that can spawn processes. Mitigations are available for both OpenCode issues: **CVE-2026-22812** is fixed in **OpenCode 1.0.216**, and **CVE-2026-22813** is fixed in **OpenCode 1.1.10**. Other items in the set describe unrelated vulnerabilities in different products (e.g., a command-injection flaw in an end-of-life VS Code extension, unsafe deserialization in *LlamaIndex*, ReDoS in *LangChain*, and various web app SQLi/XSS/access-control issues) and do not materially change the OpenCode risk picture; they should be tracked separately by affected-asset ownership and exposure.
Jun 29, 2026