OS Command Injection in Rovr via Malicious Filenames

Rovr versions through 0.10.3 are affected by an OS command injection vulnerability residing in the application's file handling logic. The vulnerability exists within the open_file function, which fails to properly sanitize filenames before processing them in a system shell. An attacker can exploit this by distributing files with specially crafted names containing shell metacharacters, such as the ampersand (&). When a user opens such a file using the vulnerable Rovr application on a Windows system, the application inadvertently interprets the filename as part of a shell command, leading to the execution of arbitrary commands with the privileges of the user running the process. This vulnerability is particularly concerning as it relies on common user interaction - opening a file - to achieve compromise.

Impact

Successful exploitation allows for unauthorized code execution within the security context of the logged-in user. This may lead to further system compromise, data exfiltration, or the deployment of additional malicious payloads. The scope of targeting is limited to users of Rovr versions 0.10.3 and below on Windows platforms.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Patch Rovr to a version beyond 0.10.3 immediately to remediate CVE-2026-110233.
• Implement monitoring for suspicious child processes spawned by the Rovr application, such as cmd.exe or powershell.exe, which should not occur during standard file opening operations.