CVE-2025-65946
Published: 21 November 2025
Summary
CVE-2025-65946 is a high-severity Improper Input Validation (CWE-20) vulnerability in Roocode Roo Code. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 23.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the LLM/Generative AI Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates input validation at interfaces to prevent improper validation errors that allow execution of unauthorized commands matching CWE-20.
Enforces restrictions on information inputs such as allow list prefixes for commands, directly countering the bypass of prefix validation in Roo Code.
Requires timely identification, reporting, and patching of flaws like the validation error fixed in Roo Code version 3.26.7.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables arbitrary command execution by bypassing allow list validation in the Roo Code AI coding agent, facilitating command and scripting interpreter abuse (T1059), proxy execution via trusted developer utilities (T1127), and exploitation for client execution (T1203).
NVD Description
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list prefixes.…
more
This issue has been patched in version 3.26.7.
Deeper analysisAI
CVE-2025-65946 is a validation error in Roo Code, an AI-powered autonomous coding agent that integrates into users' editors. In versions prior to 3.26.7, the agent could automatically execute commands that did not match the configured allow list prefixes due to improper input validation. This vulnerability, linked to CWE-20 (Improper Input Validation) and CWE-77 (Command Injection), carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-11-21.
Remote attackers can exploit the vulnerability over the network, though it requires high attack complexity and no privileges or user interaction. Exploitation allows attackers to achieve high-impact effects on confidentiality, integrity, and availability by tricking the agent into automatically executing arbitrary commands outside the intended allow list.
The vulnerability has been patched in Roo Code version 3.26.7. Mitigation involves upgrading to this version or later. Details on the fix are documented in the GitHub security advisory (GHSA-hwm7-w97p-4h8p), pull request #7667, and commit b50104cc5987ce64f5154309d967ae8c74cfd1f3.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Roo Code is explicitly described as an 'AI-powered autonomous coding agent' that integrates into users' editors, fitting the Enterprise AI Assistants category as an AI assistant for coding tasks.