https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 21:09:29 +0000 https://cve.radiocsirt.org/vuln/cve-2025-58374 <p><strong>Affected:</strong> RooCodeInc Roo-Code</p> <p>Roo Code is an AI-powered autonomous coding agent that lives in users&#39; editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle scripts, if a repository’s package.json file contains a malicious postinstall script, it would be executed automatically without user approval. This means that enabling auto-approved commands and opening a malicious repo could result in arbitrary code execution. This is fixed in version 3.26.0.</p> <p><strong>Affected:</strong> RooCodeInc Roo-Code</p> <p>Roo Code is an AI-powered autonomous coding agent that lives in users&#39; editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle scripts, if a repository’s package.json file contains a malicious postinstall script, it would be executed automatically without user approval. This means that enabling auto-approved commands and opening a malicious repo could result in arbitrary code execution. This is fixed in version 3.26.0.</p> https://cve.radiocsirt.org/vuln/cve-2025-58374