HIGH 8.4 NVD
CVE-2026-110233
Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attack
Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.
References
- https://github.com/NSPC911/rovr/blob/888a1efecd9eb92a773bb21451244c0edcf1a3f1/src/rovr/fun
- https://github.com/NSPC911/rovr/blob/888a1efecd9eb92a773bb21451244c0edcf1a3f1/src/rovr/fun
- https://github.com/NSPC911/rovr/releases/tag/v0.10.3
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HyCwXmsjfe
- https://pypi.org/project/rovr/0.10.3/
This high severity vulnerability with a CVSS score of 8.4 was published on 2026-10-13 via NVD.
vulnfeed aggregates 14602 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.