« Volver al listado

CVE-2025-53536

Estado: AnalizadaAlta (8.1)—

Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker with the ability to submit prompts to the agent could write to VS Code settings files and trigger code execution. There were multiple ways to achieve that. One example is with the php.validate.executablePath setting which lets you set the path for the php executable for syntax validation. The attacker could have written the path to an arbitrary command there and then created a php file to trigger it. This vulnerability is fixed in 3.22.6.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad en aplicación web (Roo Code) accesible remotamente que permite envío de prompts sin autenticación (AV:N, PR:N). Ejecución de comandos arbitrarios mediante manipulación de configuración de VS Code (php.validate.executablePath). Manipulación de archivos de configuración como impacto sec

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentRestrict File and Directory PermissionsRemote Data StorageNetwork Segmentation

Tecnologías afectadas (1)

Roocode — ROO Code

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-53536",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53536",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-08T13:29:26.664118Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "RooCodeInc",
          "product": "Roo-Code",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.22.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-07-07T18:15:28.980",
  "references": [
    {
      "url": "https://github.com/RooCodeInc/Roo-Code/commit/1be6fce1a6864ae63e8160b0666db2c647f2dbba",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/RooCodeInc/Roo-Code/commit/3993406ebdc0553a32ef391a799a4fb124930a1c",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-3765-5vjr-qjgm",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-552"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had \"Write\" auto-approved, an attacker with the ability to submit prompts to the agent could write to VS Code settings files and trigger code execution. There were multiple ways to achieve that. One example is with the php.validate.executablePath setting which lets you set the path for the php executable for syntax validation. The attacker could have written the path to an arbitrary command there and then created a php file to trigger it. This vulnerability is fixed in 3.22.6."
    },
    {
      "lang": "es",
      "value": "Roo Code es un agente de codificación autónomo basado en IA. Antes de la versión 3.22.6, si la víctima tenía la opción \"Escribir\" aprobada automáticamente, un atacante con la capacidad de enviar solicitudes al agente podía escribir en los archivos de configuración de VS Code y activar la ejecución del código. Había varias maneras de lograrlo. Un ejemplo es la configuración php.validate.executablePath, que permite establecer la ruta del ejecutable PHP para la validación de sintaxis. El atacante podría haber escrito la ruta a un comando arbitrario y luego haber creado un archivo PHP para activarlo. Esta vulnerabilidad se corrigió en la versión 3.22.6."
    }
  ],
  "lastModified": "2026-06-17T09:38:24.343",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:roocode:roo_code:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF0738FD-1069-4614-A4B9-3C45E7312B41",
              "versionEndExcluding": "3.22.6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}