CVE-2026-110233

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110233
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110233.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110233
Published
2026-10-13T18:50:15Z
Modified
2026-10-16T02:30:43Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
rovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe
Details

Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110233.json"
}
References

Affected packages

Git / github.com/nspc911/rovr

Affected ranges

Type
GIT
Repo
https://github.com/nspc911/rovr
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
888a1efecd9eb92a773bb21451244c0edcf1a3f1
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "0.10.3"
        },
        {
            "fixed":  "0.10.3"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.3
v0.0.3-post1
v0.0.3-post2
v0.0.3-post3
v0.0.4
v0.0.4-post1
v0.0.4-post2
v0.1.0
v0.1.0-post1
v0.10.0
v0.10.0.dev1
v0.10.0rc1
v0.10.1
v0.10.1.post1
v0.10.2
v0.10.2.post1
v0.2.0
v0.2.1
v0.2.1-post1
v0.2.1-post2
v0.3.0
v0.4.2
v0.4.3
v0.4.3.post1
v0.4.3.post2
v0.5.0
v0.6.0
v0.6.0.dev1
v0.6.0.dev2
v0.6.0rc1
v0.7.0
v0.7.0.dev1
v0.7.0.dev2
v0.7.0.dev3
v0.8.0
v0.8.0.dev1
v0.8.0.dev2
v0.8.0.dev3
v0.8.0pre1
v0.8.1
v0.8.2
v0.8.2.post1
v0.9.0
v0.9.0.dev1
v0.9.0.dev2
v0.9.0pre1
v0.9.1
v0.9.1.post1
v0.9.1.post2
v0.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110233.json"