CVE-2025-58370
Published: 05 September 2025
Summary
CVE-2025-58370 is a high-severity OS Command Injection (CWE-78) vulnerability in Roocode Roo Code. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 44.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the LLM/Generative AI Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates prompts and command inputs to the parsing logic, preventing injection attacks exploiting Bash parameter expansions and indirect references.
Requires timely remediation of the command parsing flaw through patching to version 3.26.0 or later.
Enforces least functionality by disabling auto-approval of command executions, blocking exploitation even if prompts are influenced.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables arbitrary Unix shell command execution (T1059.004) through improper handling of Bash parameter expansions and indirect references in command parsing, exploitable via influenced prompts in the client-side AI coding agent (T1203).
NVD Description
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent was…
more
configured to auto-approve execution of certain commands, an attacker able to influence prompts could abuse this weakness to execute additional arbitrary commands alongside the intended one. This is fixed in version 3.26.0.
Deeper analysisAI
CVE-2025-58370 affects Roo Code, an AI-powered autonomous coding agent integrated into users' editors, in versions below 3.26.0. The vulnerability resides in the command parsing logic, where Bash parameter expansion and indirect references are not handled correctly, enabling a form of command injection classified under CWE-78. This flaw has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to potential for significant confidentiality, integrity, and availability impacts.
An attacker who can influence the prompts provided to the agent could exploit this issue if the agent is configured to auto-approve execution of certain commands. By crafting malicious prompts, the attacker can abuse the parsing weakness to execute additional arbitrary commands alongside the intended one, potentially leading to full system compromise on the developer's machine where the agent runs.
The vulnerability is addressed in Roo Code version 3.26.0, as detailed in the security advisory at https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-2rm5-cvcm-7592. Security practitioners should urge users to update to 3.26.0 or later and review configurations to disable auto-approval of command executions where possible.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Roo Code is described as an AI-powered autonomous coding agent integrated into users' editors, fitting the Enterprise AI Assistants category as it functions as an AI assistant for coding tasks.