{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-110202",
    "name": "CVE-2026-110202",
    "vendor": "@continuedev/cli",
    "description": "VulnCheck published a run of CVEs on 12 and 13 October 2026 for coding agents whose shell-command approval could be slipped by prompt-injected commands. Roo Code through 3.54.0 received five (CVE-2026-110202 to CVE-2026-110206, each CVSS 3.1 8.8 and CVSS 4.0 7.7), all in its command parser when auto-approve is on: a bare >& redirect, quote-masking that hides separators, ${ command; } substitution on bash 5.3+ or ksh93, a $(...) substitution next to a * or ? glob (echo *$(...)) whose token the parser discards, and a substitution in command position such as $(echo touch /tmp/x). Each makes a denied command look like an allowlisted prefix such as echo. The Roo Code repository was archived on 16 May 2026 and v3.54.0 is its last release, so none of the five will be fixed. Continue CLI (@continuedev/cli) through 1.5.47 runs commands chained after an approved Bash prefix rule with ;, && or | (CVE-2026-109560, CVSS 3.1 7.5), and no fix is listed. Mistral Vibe before 2.25.4 ran a command substitution hidden in a single-quoted variable and re-expanded with bash's ${var@P} operator, which its tree-sitter classifier could not see (CVE-2026-109429, CVSS 3.1 8.8); 2.25.4 shipped on 12 September. goose 1.28.0 to 1.43.x kept read-only tool annotations after a session left Smart Approval mode, so prompt-injected calls to tools marked readOnlyHint ran without a prompt in Manual Approval mode (CVE-2026-109561, CVSS 4.0 2.3); fixed in 1.44.0. No exploitation has been reported.",
    "website": "https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-glob-token-discarding-command-substitution",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "unknown",
      "packageName": "@continuedev/cli",
      "command": null
    },
    "configFiles": null,
    "category": "package",
    "updatedAt": "2026-10-13",
    "risk": {
      "score": 88,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-110202",
      "aliases": [
        "ti-143"
      ],
      "title": "Command-Approval Bypasses in Four Coding Agents: Five Roo Code CVEs That Will Never Be Fixed, Continue CLI Command Chaining, Mistral Vibe ${var@P}, and goose Read-Only Annotations",
      "summary": "VulnCheck published a run of CVEs on 12 and 13 October 2026 for coding agents whose shell-command approval could be slipped by prompt-injected commands. Roo Code through 3.54.0 received five (CVE-2026-110202 to CVE-2026-110206, each CVSS 3.1 8.8 and CVSS 4.0 7.7), all in its command parser when auto-approve is on: a bare >& redirect, quote-masking that hides separators, ${ command; } substitution on bash 5.3+ or ksh93, a $(...) substitution next to a * or ? glob (echo *$(...)) whose token the parser discards, and a substitution in command position such as $(echo touch /tmp/x). Each makes a denied command look like an allowlisted prefix such as echo. The Roo Code repository was archived on 16 May 2026 and v3.54.0 is its last release, so none of the five will be fixed. Continue CLI (@continuedev/cli) through 1.5.47 runs commands chained after an approved Bash prefix rule with ;, && or | (CVE-2026-109560, CVSS 3.1 7.5), and no fix is listed. Mistral Vibe before 2.25.4 ran a command substitution hidden in a single-quoted variable and re-expanded with bash's ${var@P} operator, which its tree-sitter classifier could not see (CVE-2026-109429, CVSS 3.1 8.8); 2.25.4 shipped on 12 September. goose 1.28.0 to 1.43.x kept read-only tool annotations after a session left Smart Approval mode, so prompt-injected calls to tools marked readOnlyHint ran without a prompt in Manual Approval mode (CVE-2026-109561, CVSS 4.0 2.3); fixed in 1.44.0. No exploitation has been reported.",
      "severity": "high",
      "cvss": {
        "score": 8.8,
        "vector": null,
        "version": "3.1"
      },
      "cwe": [],
      "attackType": [
        "Command injection",
        "Prompt injection"
      ],
      "componentType": "package",
      "component": {
        "name": "@continuedev/cli",
        "vendor": null,
        "package": "@continuedev/cli",
        "ecosystem": null,
        "catalogSlug": "agent/continue-cli"
      },
      "affected": [
        {
          "range": "<=1.5.47",
          "fixed": "2.25.4"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-13",
      "modifiedAt": "2026-10-13",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "advisory",
          "url": "https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-glob-token-discarding-command-substitution"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110202"
        }
      ],
      "mitigation": "Uninstall Roo Code and move to a maintained agent, since no fix will ship; until then turn off auto-approve for command execution. For Continue CLI, avoid Bash prefix allow rules and require approval for every shell command until a fixed release is published. Upgrade Mistral Vibe to 2.25.4 or later and goose to 1.44.0 or later. In every agent, assume any content the agent reads can get past allowlist-based auto-approval, and run agents that execute shell commands without approval in a sandbox that has no production credentials.",
      "detectedByAnomity": false
    }
  }
}