CVE-2026-81837 | RooCodeInc Roo-Code up to 3.51.1 ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal

A vulnerability marked as critical has been reported in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. This vulnerability only affects products that are no longer supported by the maintainer.

The identification of this vulnerability is CVE-2026-81837. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

Multiple isses were reported to the vendor beforehand. They explain, that “they all apply to Roo Code, a project we no longer support – the repository was archived a while ago, and we don’t encourage anyone to use it.”VulDB Recent EntriesRead More