VULNERABILITY INTELLIGENCE

CVE-2025-65946

CVSS score8.1 HIGH
EPSS probability0.71%
CISA KEVNot currently listed
Published2025-11-21
Last modified2026-10-18
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list prefixes. This issue has been patched in version 3.26.7.

Weakness classification

  • security-advisories@github.com: CWE-20
  • nvd@nist.gov: CWE-77

Primary references