CVE-2026-110233

Awaiting Analysis Awaiting Analysis - Queue

Rovr OS Command Injection via Malicious File Names

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110233

EUVD

EUVD-2026-99017

Affected Vendors & Products

Vendor	Product	Version / Range
NSPC911	rovr	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-110233 is an OS command injection flaw in rovr 0.10.3 for Windows. It occurs when rovr passes file paths directly to cmd.exe /c start without proper escaping. Attackers can craft filenames with shell metacharacters like & to inject and execute arbitrary commands with the user's privileges when the file is opened in rovr.

Detection Guidance

Check for files with suspicious metacharacters in names like &, |, <, >, or parentheses in directories where rovr is used. Inspect rovr's open_file function in path.py for improper shell escaping. Monitor command execution logs for unexpected cmd.exe /c start commands with multiple arguments.

Impact Analysis

An attacker could place a malicious file in a writable directory or distribute it via removable media. If you open such a file in rovr, the attacker could execute arbitrary commands on your system with your user privileges. This could lead to data theft, malware installation, or system compromise.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized code execution with user privileges. If exploited, attackers could access, modify, or exfiltrate sensitive data, leading to breaches of confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Update rovr to a patched version if available. Replace cmd.exe /c start with safer alternatives like os.startfile() or ShellExecuteW. Ensure file paths are properly quoted and escaped. Avoid opening files from untrusted sources.

Hi! I’m here to help you understand CVE-2026-110233. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70