Overview
A significant vulnerability has been identified in the AI-powered autonomous coding agent, Roo Code, that could potentially compromise system security or cause data leakage. This vulnerability, known as CVE-2025-58372, pertains to versions 3.25.23 and below of Roo Code, and it affects all users who have not yet updated their software. This issue is of great concern as it can enable attackers to execute arbitrary code, potentially leading to a full system compromise.
Vulnerability Summary
CVE ID: CVE-2025-58372
Severity: High (CVSS score 8.1)
Attack Vector: Local
Privileges Required: Low
User Interaction: Required
Impact: System compromise, data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Roo Code | Versions 3.25.23 and below
How the Exploit Works
The exploit takes advantage of a vulnerability in Roo Code where certain VS Code workspace configuration files (.code-workspace) are not as protected as the .vscode folder. If the agent was configured to auto-approve file writes, an attacker able to influence prompts (for example via prompt injection) could cause malicious workspace settings or tasks to be written. These tasks could then be executed automatically when the workspace is reopened, leading to arbitrary code execution.
Conceptual Example Code
Consider the following pseudocode as a conceptual example of how the vulnerability might be exploited:
# Attacker injects malicious prompt
inject_prompt("malicious.task")
# Roo Code auto-approves the file write
approve_file_write("malicious.task")
# Malicious task is written into workspace settings
write_to_workspace("malicious.task")
# When workspace is reopened, malicious task is automatically executed
reopen_workspace_execute_task("malicious.task")In this example, the attacker injects a malicious task via a prompt. Roo Code, if set to auto-approve file writes, approves the write of the malicious task. The task is then written into the workspace settings. When the workspace is reopened, the malicious task is automatically executed, leading to arbitrary code execution.
How to Mitigate the Vulnerability
The most effective way to mitigate this vulnerability is by applying the vendor patch. Roo Code has addressed this issue in version 3.26.0, so updating to this version or later will fix the vulnerability. As a temporary solution, users may also use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to detect and prevent potential attacks exploiting this vulnerability. However, these are not long-term solutions and it is strongly recommended to apply the vendor patch as soon as it becomes available.
