PT-2025-36341 · Robocode · Robocode

Thelicato · Published 2025-09-05 · Updated 2025-09-06 · CVE-2025-58373

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Roo Code versions 3.25.23 and below

Description Roo Code, an AI-powered autonomous coding agent, is susceptible to a bypass of its .rooignore protections when using symlinks. This allows an attacker with write access to the workspace to read files intended to be excluded. Consequently, sensitive files, such as .env or configuration files, could be exposed. An attacker modifying files within the workspace could gain unauthorized access to sensitive information by circumventing .rooignore rules, potentially including secrets and configuration details.

Recommendations Update to version 3.26.0 or later.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2025-58373

GHSA-P76R-7MC3-QH7C

Affected Products

Robocode

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58373.json · Exploit
• https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-p76r-7mc3-qh7c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58373 · Security Note
• https://github.com/RooCodeInc/Roo-Code/pull/7405 · Note
• https://github.com/RooCodeInc/Roo-Code/releases/tag/v3.26.0 · Note
• https://twitter.com/CVEnew/status/1964195408655380720 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1964268042017272071 · Twitter Post
• https://t.me/cveNotify/134524 · Telegram Post
• https://t.me/CVEtracker/31834 · Telegram Post