Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck
CVE-2026-110233rovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe
High 7.8
In plain English
A high-severity OS command injection in rovr from NSPC911. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)1.2%top 32.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HyCwXmsjfe third-party-advisory
- https://github.com/NSPC911/rovr/blob/888a1efecd9eb92a773bb21451244c0edcf1a3f1/src/rovr/functions/path.py#L115-L158 technical-description
- https://github.com/NSPC911/rovr/blob/888a1efecd9eb92a773bb21451244c0edcf1a3f1/src/rovr/functions/path.py#L642-L701 technical-description
- v0.10.3 Release Notes release-notes
- https://pypi.org/project/rovr/0.10.3/ product
- VulnCheck Advisory: rovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe third-party-advisory