Roo Code OS Command Injection Vulnerability Leading to Remote Code Execution

A critical OS command injection vulnerability has been identified in Roo Code's command auto-approval module, affecting versions through 3.46.1. This vulnerability undermines the application's whitelist security mechanism by allowing attackers to exploit fragile regular expressions used for command validation. The issue arises from the application's failure to properly handle standard Shell command substitution, specifically with backticks and certain characters. As a result, an attacker can inject malicious commands that are misidentified as safe, leading to remote code execution without any user interaction.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.