Overview
CVE-2025-58370 is a high severity vulnerability discovered in Roo Code, an AI-powered autonomous coding agent that can be integrated into various coding editors. The vulnerability lies in the command parsing logic of Roo Code versions below 3.26.0. It was discovered that the Bash parameter expansion and indirect reference were not properly handled, leading to a potential security issue. The vulnerability is significant because it can lead to system compromise or data leak if exploited by an attacker. All users of Roo Code versions below 3.26.0 are affected and encouraged to update immediately.
Vulnerability Summary
CVE ID: CVE-2025-58370
Severity: High (CVSS: 8.1)
Attack Vector: Remote
Privileges Required: None
User Interaction: Required
Impact: System compromise, data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Roo Code | Versions below 3.26.0
How the Exploit Works
An attacker can exploit this vulnerability by manipulating the command prompts. If the agent is configured to auto-approve the execution of certain commands, the attacker can insert additional arbitrary commands alongside the intended ones. This is possible due to the incorrect handling of Bash parameter expansion and indirect reference in command parsing logic. This would allow the attacker to execute arbitrary commands on the system where Roo Code is installed, potentially leading to system compromise or data leakage.
Conceptual Example Code
Here is a hypothetical example of how an attacker might exploit the vulnerability:
# Original legitimate command
roo_code_command --execute="legitimate_command"
# Exploited command
roo_code_command --execute="legitimate_command; malicious_command"In this example, `legitimate_command` is a command that the AI agent is configured to auto-approve, and `malicious_command` is an additional arbitrary command inserted by the attacker. If the agent executes this command, it would also execute the malicious command, leading to a potential security breach.
Mitigation Guidance
To mitigate this vulnerability, users are advised to update their Roo Code to version 3.26.0, where this vulnerability is fixed. If updating is not an immediate option, users can employ a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as a temporary measure to block malicious attempts to exploit this vulnerability. However, this is not a permanent solution and updating to the fixed version is strongly recommended.
