Skip to content
OpenAdvisories
Critical · 9.9 Public exploit CVE-2025-58371 EUVD-2025-27053

Roo Code is vulnerable to command injection via GitHub actions workflow

Published Sep 5, 2025 · Updated Sep 8, 2025 · Assigned by GitHub_M

Vendor: RooCodeInc Product: Roo-Code

Description

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request metadata in a privileged context, allowing an attacker to craft malicious input and achieve Remote Code Execution (RCE) on the Actions runner. The workflow runs with broad permissions and access to repository secrets. It is possible for an attacker to execute arbitrary commands on the runner, push or modify code in the repository, access secrets, and create malicious releases or packages, resulting in a complete compromise of the repository and its associated services. This is fixed in version 3.26.7.

Affected products

VendorProductAffectedFixed
RooCodeInc Roo-Code < 3.26.7 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • pvharmo2/gha-lab-d14c91f1bb ★ 0 · Sep 4, 2026

    Security-research lab: reproduction of CVE-2025-58371 (GitHub Actions command injection via PR title in Discord PR Notifier), snapshot of RooCodeInc/Roo-Code @ 08a825f9bb0086a88cff5a79b9af4731bba7d076

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References