CVE-2026-110233

CVSS 8.4 (high) · published 2026-10-13

Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.

Weakness: CWE-78

Source: NVD CVE-2026-110233

References

• https://github.com/NSPC911/rovr/blob/888a1efecd9eb92a773bb21451244c0edcf1a3f1/src/rovr/functions/path.py#L115-L158
• https://github.com/NSPC911/rovr/blob/888a1efecd9eb92a773bb21451244c0edcf1a3f1/src/rovr/functions/path.py#L642-L701
• https://github.com/NSPC911/rovr/releases/tag/v0.10.3
• https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HyCwXmsjfe
• https://pypi.org/project/rovr/0.10.3/
• https://www.vulncheck.com/advisories/rovr-through-0.10.3-os-command-injection-via-unquoted-path-to-cmd-exe
• https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HyCwXmsjfe

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.