Roo Code: Command Allowlist Bypass via Unsplit '|&' Operator Allows Denied Commands to Execute

Vulnerability Summary: Pipe Operator Bypasses Auto-Approve Command Allowlist Vulnerability Overview Vulnerability Type: Command Allowlist Bypass Root Cause: The function's list of operators ( ) used when splitting commands is missing . Trigger Conditions: When is enabled, Roo Code automatically approves shell commands proposed by the agent. Because is not recognized as an operator, a command like is treated as a single sub-command as a whole. Consequence: Since the command starts with (which is in the allowlist), it is auto-approved and executed as a pipeline, causing the command, which is outside the allowlist, to be executed as well. Scope of Impact Affected Versions: Commit (v5.3.0) Impact: Denied or unlisted commands placed after are folded into an already-approved command and executed by bash, thereby bypassing the allowlist control. Practical Impact: This constitutes an indirect prompt injection: untrusted content read by the agent (files, web pages, repositories, MCP results) can embed a denied command following , which will run on the developer's machine with the agent's auto-execute permissions. Remediation 1. Direct Fix: Add to the operator list in (line 15) so that pipelines are correctly split into independent sub-commands, with each sub-command checked individually. 2. More Robust Fix: Derive the set of command delimiters from bash syntax rather than using an inline literal; any operator not explicitly categorized should, by default, fold subsequent commands into the approved command (requiring approval), rather than appending them to the current command. POC Code Core Vulnerability Code ( ) > Note: is not in the list, so it enters the branch and is treated as part of the command rather than as a delimiter. POC Test Code ( ) POC Execution Results Bash Verification > The file is created, proving that the denied command was executed while the gate only approved .

Goal Reached Thanks to every supporter — we hit 100%!

Roo Code: Command Allowlist Bypass via Unsplit '|&' Operator Allows Denied Commands to Execute

More from this source