CVE-2025-57771
Published: 22 August 2025
Summary
CVE-2025-57771 is a high-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 43.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the LLM/Generative AI Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of crafted prompts in the command parsing logic to block injection via process substitution and single ampersand characters.
Directly remediates the command injection flaw by applying patches to version 3.25.5 or later with improved parsing logic.
Enforces least functionality by disabling non-essential auto-approved execution, which is required for exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows command injection via crafted prompts using process substitution and ampersand characters when auto-execute is enabled, facilitating exploitation of the client application (T1203) for arbitrary Unix shell command execution (T1059.004).
NVD Description
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions prior to 3.25.5, Roo-Code fails to properly handle process substitution and single ampersand characters in the command parsing logic for auto-execute commands. If a user…
more
has enabled auto-approved execution for a command such as ls, an attacker who can submit crafted prompts to the agent may inject arbitrary commands to be executed alongside the intended command. Exploitation requires attacker access to submit prompts and for the user to have enabled auto-approved command execution, which is disabled by default. This vulnerability could allow an attacker to execute arbitrary code. The issue is fixed in version 3.25.5.
Deeper analysisAI
CVE-2025-57771 is an OS command injection vulnerability (CWE-78) in Roo Code, an AI-powered autonomous coding agent that integrates into users' editors. Affecting versions prior to 3.25.5, the flaw arises from improper handling of process substitution and single ampersand characters in the command parsing logic for auto-execute commands. This allows crafted inputs to inject arbitrary commands when auto-approved execution is enabled for specific commands, such as ls. The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-08-22.
An attacker with the ability to submit prompts to the Roo Code agent can exploit this vulnerability by crafting inputs that leverage the parsing flaw to execute arbitrary commands alongside the intended one. Exploitation requires the user to have explicitly enabled auto-approved command execution, which is disabled by default, and does not necessitate privileges beyond prompt submission access. Successful exploitation enables arbitrary code execution on the user's system, potentially leading to high confidentiality, integrity, and availability impacts.
The Roo Code security advisory (GHSA-wrh9-463x-7wvv) and associated commit (de359a465c67aefc67553aa2b464591b602c4bdc) confirm the issue is fixed in version 3.25.5 through improvements to command parsing logic. Users should update to 3.25.5 or later and ensure auto-approved execution remains disabled unless necessary.
This vulnerability highlights security risks in AI-powered coding agents, where prompt injection can lead to command execution in development environments, underscoring the need for robust input sanitization in AI/ML-assisted tools. No real-world exploitation has been reported.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Roo Code is described as an AI-powered autonomous coding agent integrated into users' editors, functioning as an AI assistant for code generation and execution, aligning with Enterprise AI Assistants category.