{"id":74629,"date":"2025-09-13T11:01:57","date_gmt":"2025-09-13T11:01:57","guid":{"rendered":""},"modified":"2025-10-17T00:33:42","modified_gmt":"2025-10-17T06:33:42","slug":"cve-2025-58372-roo-code-vulnerability-leading-to-arbitrary-code-execution","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-58372-roo-code-vulnerability-leading-to-arbitrary-code-execution\/","title":{"rendered":"CVE-2025-58372: Roo Code Vulnerability Leading to Arbitrary Code Execution<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

A significant vulnerability has been identified in the AI-powered autonomous coding agent, Roo Code, that could potentially compromise system security or cause data leakage. This vulnerability, known as CVE-2025-58372, pertains to versions 3.25.23 and below of Roo Code, and it affects all users who have not yet updated their software. This issue is of great concern as it can enable attackers to execute arbitrary code<\/a>, potentially leading to a full system compromise.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-58372
\nSeverity: High (CVSS score 8.1)
\nAttack Vector: Local
\nPrivileges Required: Low
\nUser Interaction: Required
\nImpact: System compromise<\/a>, data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Roo Code<\/a> | Versions 3.25.23 and below<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of a vulnerability in Roo Code<\/a> where certain VS Code workspace configuration files (.code-workspace) are not as protected as the .vscode folder. If the agent was configured to auto-approve file<\/a> writes, an attacker able to influence prompts (for example via prompt injection) could cause malicious workspace settings or tasks to be written. These tasks could then be executed automatically when the workspace is reopened, leading to arbitrary code execution<\/a>.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Consider the following pseudocode as a conceptual example of how the vulnerability might be exploited:<\/p>\n

# Attacker injects malicious prompt\ninject_prompt(\"malicious.task\")\n# Roo Code auto-approves the file write\napprove_file_write(\"malicious.task\")\n# Malicious task is written into workspace settings\nwrite_to_workspace(\"malicious.task\")\n# When workspace is reopened, malicious task is automatically executed\nreopen_workspace_execute_task(\"malicious.task\")<\/code><\/pre>\n
In this example, the attacker injects a malicious task via<\/a> a prompt. Roo Code<\/a>, if set to auto-approve file writes, approves the write of the malicious task. The task is then written into the workspace settings. When the workspace is reopened, the malicious task is automatically executed, leading to arbitrary code<\/a> execution.<\/p>\n
How to Mitigate the Vulnerability<\/strong><\/p>\n
The most effective way to mitigate this vulnerability is by applying the vendor patch. Roo Code has addressed this issue in version 3.26.0, so updating to this version or later will fix the vulnerability<\/a>. As a temporary solution, users may also use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to detect and prevent potential attacks exploiting this vulnerability<\/a>. However, these are not long-term solutions and it is strongly recommended to apply the vendor patch as soon as it becomes available.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview A significant vulnerability has been identified in the AI-powered autonomous coding agent, Roo Code, that could potentially compromise system security or cause data leakage. This vulnerability, known as CVE-2025-58372, pertains to versions 3.25.23 and below of Roo Code, and it affects all users who have not yet updated their software. This issue is of […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-74629","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t