Product
The iSay component in MOOS-IvP through 24.8.1 is vulnerable to remote code execution because it passes unsanitized SAY_MOOS variable content directly to a shell, allowing command injection via backticks or substitution syntax.