CVE-2026-85425: MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS
MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAYMOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAYMOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process user.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker who can publish messages to the MOOS variable named SAY_MOOS can exploit it remotely. No authentication, user interaction, or special privileges are indicated by the supplied severity vector.
What access does successful exploitation provide?
A crafted SAY_MOOS message using backticks or command-substitution syntax can execute arbitrary operating-system commands. Those commands run with the privileges of the iSay process user.
Which releases are affected?
MOOS-IvP iSay through version 24.8.1 is affected.
What should be prioritized if remediation cannot be applied immediately?
Restrict who can publish to the SAY_MOOS MOOS variable, since publishing attacker-controlled content to that handler is the exploitation prerequisite. Limit the iSay process user's operating-system privileges to reduce the impact of command execution.