CVE-2026-110233
HIGH
NVD
CVSS Score
7.8
Severity
HIGH
Published
Oct 13, 2026
Vendor
unknown
Description
Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.
References
- https://github.com/NSPC911/rovr/blob/888a1efecd9eb92a773bb21451244c0edcf1a3f1/src/rovr/functions/path.py#L115-L158
- https://github.com/NSPC911/rovr/blob/888a1efecd9eb92a773bb21451244c0edcf1a3f1/src/rovr/functions/path.py#L642-L701
- https://github.com/NSPC911/rovr/releases/tag/v0.10.3
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HyCwXmsjfe
- https://pypi.org/project/rovr/0.10.3/