PT-2025-30619 · Robocode · Robocode

Maccarita + 1 · Published 2025-07-23 · Updated 2025-07-24 · CVE-2025-54377

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roo Code versions 3.23.18 and below

Description Roo Code, an AI-powered autonomous coding agent, does not validate line breaks ( ) in its command input. This bypasses the allow-list mechanism due to a lack of parsing or validation logic, potentially enabling command injection. Only the first line or token may be considered during command evaluation, allowing attackers to smuggle additional commands in subsequent lines.

Recommendations Update to Roo Code version 3.23.19 or later.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2026-00186

CVE-2025-54377

GHSA-P278-52X9-CFFX

Affected Products

Robocode

References · 9

• 🔥 https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-p278-52x9-cffx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54377.json · Exploit
• https://github.com/RooCodeInc/Roo-Code/commit/9d434c2db9b20eb5c78b698cb2b0037cd2074534 · Patch
• https://bdu.fstec.ru/vul/2026-00186 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54377 · Security Note
• https://t.me/CVEtracker/28523 · Telegram Post
• https://twitter.com/CVEnew/status/1948122389201453087 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1948139578981839089 · Twitter Post