PatchTheCVEroo code vulnerabilities and fixes
Recent CVEs affecting roo code, with upgrade or downgrade steps. 5 tracked.
Also searched as: roocode.
roo code has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-10-13. Highest priority: CVE-2026-110206 (score 47/100).
- CVE-2026-110206 HIGH 8.8 UPGRADE Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows att
- CVE-2026-110202 HIGH 8.8 UPGRADE Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows a
- CVE-2026-110203 HIGH 8.8 UPGRADE Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve
- CVE-2026-110204 HIGH 8.8 UPGRADE Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied s
- CVE-2026-110205 HIGH 8.8 UPGRADE Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards c
FAQ
How do I fix roo code vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is roo code being exploited right now?
None of the tracked roo code CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which roo code CVE should I patch first?
CVE-2026-110206 currently ranks highest (47/100): Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows att.