CyberRota Analysis
AI-GeneratedRooCodeInc Roo-Code versions up to 3.51.1 are vulnerable to a remote code injection due to flaws in the fetch_instructions function within the malicious_mcp_server.py file of the MCP Integration Trust Model. Given that the vendor has archived the project and ceased support, organizations still using this software should prioritize remediation to mitigate potential exploitation risks. Users of this deprecated product are particularly at risk and should consider transitioning to supported alternatives.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instructions of the file malicious_mcp_server.py of the component MCP Integration Trust Model. The manipulation leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer.