CVE-2025-54377 - CVE House

Back to Database

Status published High CVE-2025-54377

Roo Code Lacks Line Break Validation in its Command Execution Tool

7.8 CVSS

Vulnerability Description

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode does not validate line breaks (\n) in its command input, allowing potential bypass of the allow-list mechanism. The project appears to lack parsing or validation logic to prevent multi-line command injection. When commands are evaluated for execution, only the first line or token may be considered, enabling attackers to smuggle additional commands in subsequent lines. This is fixed in version 3.23.19.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54377

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from RooCodeInc

View All →

Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug

Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts

Roo Code: Symlink-bypass of .rooignore can lead to unintended file disclosure

Roo Code: Potential Remote Code Execution via .code-workspace

Roo Code is vulnerable to command injection via GitHub actions workflow

Affected Vendor

RooCodeInc

View all reports →

Affected Software

Roo-Code

Vulnerable Versions:

< 3.23.19

Timeline

Official Publish: July 23rd, 2025

Last Modified: July 23rd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1105 Ingress Tool Transfer

Command and Control