PT-2025-34449 · Robocode · Robocode

Maccarita · Published 2025-08-22 · Updated 2025-08-22 · CVE-2025-57771

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Roo Code versions prior to 3.25.5

Description: Roo Code, an AI-powered autonomous coding agent, does not correctly process process substitution and single ampersand characters within its command parsing logic for auto-execute commands. If a user has enabled auto-approved execution for a command, an attacker who can submit crafted prompts to the agent may inject arbitrary commands to be executed alongside the intended command. Exploitation requires the attacker to have access to submit prompts and for the user to have enabled auto-approved command execution, which is disabled by default. This could allow an attacker to execute arbitrary code.

Recommendations: Update to version 3.25.5 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-57771

GHSA-WRH9-463X-7WVV

Affected Products

Robocode

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57771.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57771 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57771 · Vendor Advisory
• https://github.com/RooCodeInc/Roo-Code/commit/de359a465c67aefc67553aa2b464591b602c4bdc · Note
• https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-wrh9-463x-7wvv · Note
• https://twitter.com/CVEnew/status/1958933871438831618 · Twitter Post
• https://t.me/CVEtracker/30706 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1958952399260832000 · Twitter Post