PT-2025-36339 · Robocode · Robocode

Yaronav · Published 2025-09-05 · Updated 2025-09-06 · CVE-2025-58371

Positive Technologies (AI Summary)

CVSS v4.0

9.9

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Roo Code versions 3.26.6 and below

Description Roo Code is an AI-powered autonomous coding agent. A Github workflow used unsanitized pull request metadata in a privileged context, allowing an attacker to achieve Remote Code Execution (RCE) on the Actions runner. The workflow runs with broad permissions and access to repository secrets. An attacker could execute arbitrary commands on the runner, modify code in the repository, access secrets, and create malicious releases or packages, resulting in a complete compromise of the repository and its associated services.

Recommendations Update Roo Code to version 3.26.7.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-58371

GHSA-XR6R-VJ48-29F6

Affected Products

Robocode

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58371.json · Exploit
• https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-xr6r-vj48-29f6 · Vendor Advisory
• https://github.com/RooCodeInc/Roo-Code/commit/a0384f35d5ae3b7f66506cc62dda25d9bb673f49 · Patch
• https://osv.dev/vulnerability/CVE-2025-58371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58371 · Security Note
• https://twitter.com/VulmonFeeds/status/1964265482061488442 · Twitter Post
• https://t.me/CVEtracker/31832 · Telegram Post
• https://t.me/cveNotify/134522 · Telegram Post
• https://twitter.com/offseq/status/1964116451075203260 · Twitter Post
• https://twitter.com/cypmsecnews/status/1964119195714498564 · Twitter Post
• https://t.me/canyoupwnme/6915 · Telegram Post
• https://twitter.com/CVEnew/status/1964195410848993677 · Twitter Post