CVE-2025-65946

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list prefixes. This issue has been patched in version 3.26.7.

CVSS 3.1

8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-25)

CWEs

CWE-77, CWE-20

Published

2025-11-21

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• roocode:roo_code

References

• https://github.com/RooCodeInc/Roo-Code/commit/b50104cc5987ce64f5154309d967ae8c74cfd1f3
• https://github.com/RooCodeInc/Roo-Code/pull/7667
• https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-hwm7-w97p-4h8p

Check your stackJSON