CVE-2026-110233: rovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe
Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through openfile.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed?
The vulnerability is described in Rovr on Windows through version 0.10.3. The provided information does not establish exposure for other operating systems.
What must an attacker do to trigger command execution?
An attacker must provide a file whose name contains shell metacharacters, such as &, together with a payload. The malicious file must then be opened through open_file, requiring user interaction.
What access does the resulting command have?
Commands execute with the privileges of the user who opens the malicious file. The attack does not require the attacker to already have privileges on the affected system.