CVE-2026-110233
Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers…
- Risk score
- 60/100
- CVSS
- 7.8 v3.1
- Exploit chance (30 days)
- 1.1%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 7.8 high
References
- https://github.com/NSPC911/rovr/blob/888a1efecd9eb92a773bb21451244c0edcf1a3f1/src/rovr/functions/path.py#L115-L158
- https://github.com/NSPC911/rovr/blob/888a1efecd9eb92a773bb21451244c0edcf1a3f1/src/rovr/functions/path.py#L642-L701
- https://github.com/NSPC911/rovr/releases/tag/v0.10.3
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HyCwXmsjfe
- https://pypi.org/project/rovr/0.10.3/
- https://www.vulncheck.com/advisories/rovr-through-0.10.3-os-command-injection-via-unquoted-path-to-cmd-exe
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HyCwXmsjfe
Original description
Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.
Last activity 13 Oct 2026. Patch Forecast updates every hour.