CVE-2025-53536

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-53536

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53536.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-53536

Aliases

GHSA-3765-5vjr-qjgm

Published

2025-07-07T17:57:36.835Z

Modified

2026-07-15T01:49:12.182584182Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Roo Code allows Potential Remote Code Execution via .vscode/settings.json

Details

Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker with the ability to submit prompts to the agent could write to VS Code settings files and trigger code execution. There were multiple ways to achieve that. One example is with the php.validate.executablePath setting which lets you set the path for the php executable for syntax validation. The attacker could have written the path to an arbitrary command there and then created a php file to trigger it. This vulnerability is fixed in 3.22.6.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53536.json",
    "cwe_ids": [
        "CWE-552"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/roocodeinc/roo-code

Affected ranges

Type

GIT

Repo

https://github.com/roocodeinc/roo-code

Events

Introduced

Fixed

ed536a98f2d5e8668f1ed4cfb1f54460f51cb905

Fixed

1be6fce1a6864ae63e8160b0666db2c647f2dbba

Fixed

3993406ebdc0553a32ef391a799a4fb124930a1c

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.22.6"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:roocode:roo_code:*:*:*:*:*:*:*:*"
}

Affected versions

v0.*

v0.0.2

v0.0.3

v0.0.4

v0.0.5

v0.0.6

v1.*

v1.0.0

v1.0.4

v1.0.41

v1.0.51

v1.0.6

v1.0.61

v1.0.62

v1.0.63

v1.0.64

v1.0.65

v1.0.7

v1.0.71

v1.0.72

v1.0.73

v1.0.8

v1.0.81

v1.0.82

v1.0.83

v1.0.84

v1.0.85

v1.0.86

v1.0.87

v1.0.9

v1.0.91

v1.0.92

v1.0.93

v1.0.94

v1.0.95

v1.0.96

v1.0.97

v1.0.98

v1.0.99

v1.1.0

v1.1.1

v1.1.11

v1.1.12

v1.1.13

v1.1.14

v1.1.15

v1.2.0

v1.2.1

v1.2.2

v1.3.0

v1.3.1

v1.3.2

v1.3.3

v1.3.4

v1.3.41

v1.3.42

v1.3.43

v1.4.0

v1.4.1

v1.4.11

v1.4.12

v1.4.13

v1.4.14

v1.4.15

v1.4.16

v1.4.17

v1.4.18

v1.4.19

v1.4.2

v1.4.21

v1.4.22

v1.4.23

v1.4.24

v1.5.0

v1.5.01

v1.5.1

v1.5.10

v1.5.11

v1.5.12

v1.5.13

v1.5.14

v1.5.15

v1.5.16

v1.5.17

v1.5.18

v1.5.19

v1.5.2

v1.5.20

v1.5.21

v1.5.22

v1.5.23

v1.5.24

v1.5.25

v1.5.26

v1.5.27

v1.5.28

v1.5.29

v1.5.3

v1.5.30

v1.5.31

v1.5.32

v1.5.33

v1.5.34

v1.5.4

v1.5.5

v1.5.6

v1.5.7

v1.5.8

v1.5.9

v1.6.0

v1.6.1

v1.6.10

v1.6.2

v1.6.3

v1.6.4

v1.6.5

v1.6.6

v1.6.7

v1.6.8

v1.6.9

v1.7.0

v1.7.1

v1.7.2

v1.7.3

v1.7.4

v1.7.5

v1.8.0

v1.8.1

v1.9.0

v1.9.1

v1.9.2

v1.9.3

v1.9.4

v1.9.5

v1.9.6

v1.9.7

v2.*

v2.0.0

v2.0.1

v2.0.10

v2.0.11

v2.0.12

v2.0.13

v2.0.14

v2.0.15

v2.0.16

v2.0.17

v2.0.18

v2.0.19

v2.0.3

v2.0.4

v2.0.5

v2.0.6

v2.0.7

v2.0.8

v2.0.9

v2.1.0

v2.1.1

v2.1.10

v2.1.11

v2.1.12

v2.1.13

v2.1.14

v2.1.15

v2.1.16

v2.1.17

v2.1.18

v2.1.19

v2.1.2

v2.1.21

v2.1.3

v2.1.4

v2.1.5

v2.1.6

v2.1.7

v2.1.8

v2.1.9

v3.*

v3.18.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53536.json"