Vendor
Rovr through 0.10.3 contains an OS command injection vulnerability triggered by opening files with malicious names containing shell metacharacters, enabling arbitrary code execution under the user's context.