Roo Code github.com/RooCodeInc/Roo-Code ↗

Pin a Patched Version; Treat the Archived Extension as Frozen

Roo Code was archived on 15 May 2026 with no further security fixes coming from upstream. Every 2025 advisory only became safe at or after v3.26.7.

Setting: VS Code → Extensions → RooVeterinaryInc.roo-cline → "Install Specific Version"; disable auto-update for the extension.

Tip: pin to v3.26.7 or later, verify publisher ID RooVeterinaryInc, mirror the VSIX internally, evaluate migrating to a maintained fork (README points to ZooCode and back to Cline) since no further CVEs will be patched.

Disable Auto-Approve by Default; Never Enable Write or Execute Globally

The Auto-Approve dropdown exposes eight toggles — Read Operations, Write Operations, Command Execution, Browser Usage, MCP Servers, Mode Switching, Subtask Management, Follow-Up Questions — plus "Include files outside workspace" and "Include protected files" sub-options that bypass .roo/, .vscode/, and .rooignore protection. Every high-severity Roo advisory requires auto-approved writes or auto-approved execute to fire.

Setting path: Roo Code sidebar → Auto-Approve dropdown (Cmd+Alt+A / Ctrl+Alt+A) → uncheck Write, Execute, Browser, MCP, "Include files outside workspace", "Include protected files".

Tip: keep only "Read Operations" auto-approved if anything; require manual approval for every command on third-party repos; use the bottom-right Enabled master switch to pause approvals during code review.

Lock Down Command Execution with Denylist + Allowlist

execute_command parsing has been bypassed repeatedly: missing \n validation (fixed 3.23.19), zsh validation error (3.26.7), bash parameter expansion (3.26.0), process substitution + & (3.25.5), npm install postinstall (3.26.0).

Setting: Settings → Auto-Approve → Execute → "Allowed Commands" and "Denied Commands"; pick Inline Terminal or VS Code Terminal under terminal mode.

Tip: keep "Allowed Commands" minimal (e.g. npm test, tsc --noEmit, git status); never include npm install, yarn, pip, curl, bash, sh, zsh; deny curl, wget, nc, ssh, scp; firewall egress to backstop parser bypasses.

Ship a Strict .rooignore and Validate Symlink Hygiene

.rooignore (gitignore syntax at workspace root) blocks read_file, write_to_file, apply_diff, list_files. GHSA-p76r-7mc3-qh7c (Moderate, fixed 3.26.0) showed symlinks inside the workspace could redirect reads outside .rooignore coverage to expose .env.

Tip: run on v3.26.0+ so post-symlink validation is active; periodically find . -type l to audit new symlinks committed by collaborators.

Treat .roomodes, .vscode/settings.json, .code-workspace as Protected Config

Three high-severity RCEs (GHSA-3765-5vjr-qjgm .vscode/settings.json, GHSA-4pqh-4ggm-jfmm .code-workspace, GHSA-5x8h-m52g-5v54 .roo/mcp.json) all exploited the same pattern: prompt injection + auto-approved writes lets the agent rewrite a config file VS Code or Roo later executes.

Setting: keep Auto-Approve → Write → "Include protected files" disabled; the protected list covers .vscode/, *.code-workspace, everything under .roo/.

Tip: review .roomodes, .vscode/settings.json, .code-workspace, .roo/mcp.json in every PR like a CI workflow; never accept these files from forks without diffing; commit under CODEOWNERS.

Constrain Custom Modes — Use fileRegex and Minimal Tool Groups

Custom Modes in .roomodes (project) or custom_modes.yaml/.json (global) define slug, name, roleDefinition, groups, optional fileRegex. The four tool groups — read, edit, command, mcp — are the actual capability gates. A malicious .roomodes shipped via a repo can silently broaden capabilities.

Setting: project file .roomodes (YAML preferred); edit globally via Command Palette → "Roo Code: Edit Global Modes".

Tip: for docs/reviewer modes, give only read + edit with fileRegex: "\\.(md|mdx|txt)$"; never grant command and mcp together in the same custom mode; review .roomodes on first open of any new repo.

Keep Orchestrator / Boomerang Strict — No read/command by Default

Orchestrator mode (🪃) delegates subtasks to specialized modes. By design it cannot read files, write files, call MCPs, or run commands — the docs explicitly call this out as context-poisoning protection. Adding any of those groups collapses the isolation.

Setting: Command Palette → "Roo Code: Edit Global Modes" → orchestrator entry; Auto-Approve → "Always approve creation & completion of subtasks" toggle.

Tip: leave Orchestrator's groups empty by default; keep "Always approve subtasks" off so subtask handoffs require human confirmation (each handoff is also an injection boundary worth eyeballing).

Pin and Audit MCP Servers; Never Auto-Approve MCP Tools

MCP configs live in two places: global mcp_settings.json and project .roo/mcp.json. Project overrides global. Each server entry supports command, args (with ${env:VAR} substitution), env, alwaysAllow, disabled, disabledTools, timeout. GHSA-5x8h-m52g-5v54 (fixed 3.20.3) showed .roo/mcp.json being rewritten by an injected agent to add an attacker-controlled STDIO server.

Setting: MCP Servers panel → gear → "Edit Global MCP" / "Edit Project MCP".

Tip: keep alwaysAllow: [] on every server; prefer STDIO over SSE/Streamable HTTP; pass secrets through env not args; pin server versions; set disabled: true for any server not actively used.

Protect API Keys; Export Files Are Plaintext

Roo Code stores provider keys in VS Code's Secret Storage, but Settings → Export writes a roo-code-settings.json with API keys in plaintext, and roo-cline.autoImportSettingsPath will load such a file on startup — making it a credible attack target on shared machines.

Setting: Settings → API Configuration Profiles; storage override via roo-cline.customStoragePath; auto-import via roo-cline.autoImportSettingsPath.

Tip: never commit roo-code-settings.json to a repo; if you must export, encrypt the file (age, gpg) and delete the plaintext copy; do not set autoImportSettingsPath to a workspace-relative path; use short-lived scoped keys and rotate after any suspected injection.

Isolate the Workspace and Defend Against Indirect Injection

Every Roo RCE chain begins with attacker-controlled content (docstrings, READMEs, issue bodies, web fetches, MCP tool descriptions) entering the LLM context and convincing the agent to write a config file or run a command. The defenses are environmental.

Setting: .devcontainer/devcontainer.json with no SSH-agent forwarding and no ~ mount; or Remote-SSH to a disposable VM where Roo Code is installed only on the remote side.

Tip: never run Roo Code on a host holding production secrets, signing keys, or browser cookies; firewall egress to your LLM/MCP endpoints only; open untrusted repos with Auto-Approve off and .rooignore covering all secret paths.