https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 13:27:50 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-380507 EUVD-2026-380507 https://cve.radiocsirt.org/vuln/euvd-2026-380507 https://cve.radiocsirt.org/vuln/fkie_cve-2026-82537 <p>Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate&#39;s shell parser and bash. Attackers can craft a command string with an allowlisted word immediately followed by a hash character, separator, and denied command to pass the approval gate while bash executes the denied command with the agent&#39;s auto-execute privileges on the developer&#39;s machine.</p> <p>Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate&#39;s shell parser and bash. Attackers can craft a command string with an allowlisted word immediately followed by a hash character, separator, and denied command to pass the approval gate while bash executes the denied command with the agent&#39;s auto-execute privileges on the developer&#39;s machine.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-82537 https://cve.radiocsirt.org/vuln/ghsa-8fwh-72qq-gr52 <p>Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate&#39;s shell parser and bash. Attackers can craft a command string with an allowlisted word immediately followed by a hash character, separator, and denied command to pass the approval gate while bash executes the denied command with the agent&#39;s auto-execute privileges on the developer&#39;s machine.</p> <p>Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate&#39;s shell parser and bash. Attackers can craft a command string with an allowlisted word immediately followed by a hash character, separator, and denied command to pass the approval gate while bash executes the denied command with the agent&#39;s auto-execute privileges on the developer&#39;s machine.</p> https://cve.radiocsirt.org/vuln/ghsa-8fwh-72qq-gr52