OS Command Injection in Rovr by NSPC911
CVE-2026-110233

8.4HIGH

Key Information:

Vendor

Nspc911

Status
Rovr
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110233?

Rovr, up to version 0.10.3, on Windows is vulnerable to OS command injection, allowing attackers to execute arbitrary commands. By naming malicious files with shell metacharacters, such as '&', an attacker can launch payloads that run with user privileges when the affected files are opened. This could lead to unauthorized access and manipulation of system resources.

Affected Version(s)

rovr 0 <= 0.10.3

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HyCwXmsjfe
third-party-advisory
https://github.com/NSPC911/rovr/blob/888a1efecd9eb92a773b...
technical-description
https://github.com/NSPC911/rovr/blob/888a1efecd9eb92a773b...
technical-description

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.