CVE-2025-58370

HighRCE

Published: 05 September 2025

Published

05 September 2025

Modified

10 September 2025

KEV Added

—

Patch

—

CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0037 58.9th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-58370 is a high-severity OS Command Injection (CWE-78) vulnerability in Roocode Roo Code. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 41.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the LLM/Generative AI Risks risk domain.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-58370 affects Roo Code, an AI-powered autonomous coding agent integrated into users' editors, in versions below 3.26.0. The vulnerability resides in the command parsing logic, where Bash parameter expansion and indirect references are not handled correctly, enabling a form of command injection classified under CWE-78. This flaw has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to potential for significant confidentiality, integrity, and availability impacts.

An attacker who can influence the prompts provided to the agent could exploit this issue if the agent is configured to auto-approve execution of certain commands. By crafting malicious prompts, the attacker can abuse the parsing weakness to execute additional arbitrary commands alongside the intended one, potentially leading to full system compromise on the developer's machine where the agent runs.

The vulnerability is addressed in Roo Code version 3.26.0, as detailed in the security advisory at https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-2rm5-cvcm-7592. Security practitioners should urge users to update to 3.26.0 or later and review configurations to disable auto-approval of command executions where possible.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-27162

Vulnerability details

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent was…

configured to auto-approve execution of certain commands, an attacker able to influence prompts could abuse this weakness to execute additional arbitrary commands alongside the intended one. This is fixed in version 3.26.0.

CWE(s): CWE-78

AI Security AnalysisAI

AI Category: AI Agent Protocols and Integrations
Risk Domain: LLM/Generative AI Risks
OWASP Top 10 for LLMs 2025: None mapped
Classification Reason: Matched keywords: ai

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

The vulnerability enables arbitrary Unix shell command execution (T1059.004) through improper handling of Bash parameter expansions and indirect references in command parsing, exploitable via influenced prompts in the client-side AI coding agent (T1203).