{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/rovr/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rovr:rovr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-110233"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rovr (\u003c= 0.10.3)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-110233","command-injection","windows","execution"],"_cs_type":"advisory","_cs_vendors":["Rovr"],"content_html":"\u003cp\u003eRovr versions through 0.10.3 are affected by an OS command injection vulnerability residing in the application's file handling logic. The vulnerability exists within the open_file function, which fails to properly sanitize filenames before processing them in a system shell. An attacker can exploit this by distributing files with specially crafted names containing shell metacharacters, such as the ampersand (\u0026amp;). When a user opens such a file using the vulnerable Rovr application on a Windows system, the application inadvertently interprets the filename as part of a shell command, leading to the execution of arbitrary commands with the privileges of the user running the process. This vulnerability is particularly concerning as it relies on common user interaction - opening a file - to achieve compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized code execution within the security context of the logged-in user. This may lead to further system compromise, data exfiltration, or the deployment of additional malicious payloads. The scope of targeting is limited to users of Rovr versions 0.10.3 and below on Windows platforms.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Rovr to a version beyond 0.10.3 immediately to remediate CVE-2026-110233.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for suspicious child processes spawned by the Rovr application, such as cmd.exe or powershell.exe, which should not occur during standard file opening operations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T04:38:42Z","date_published":"2026-10-14T04:38:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rovr-command-injection/","summary":"Rovr through 0.10.3 contains an OS command injection vulnerability triggered by opening files with malicious names containing shell metacharacters, enabling arbitrary code execution under the user's context.","title":"OS Command Injection in Rovr via Malicious Filenames","url":"https://feed.craftedsignal.io/briefs/2026-10-rovr-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Rovr","version":"https://jsonfeed.org/version/1.1"}