CVE-2026-110233: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in NSPC911 rovr

Rovr versions up to 0.10.3 on Windows contain an OS command injection vulnerability (CVE-2026-110233) due to improper neutralization of special elements in file names. Attackers can craft file names with shell metacharacters such as '&' combined with a payload. When such a file is opened using the open_file function, the payload executes with the privileges of the user, enabling command execution on the system.

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the user opening the malicious file. This can lead to unauthorized actions on the affected system, potentially compromising system integrity and confidentiality. The CVSS 4.0 score of 8.4 indicates a high severity vulnerability with local attack vector, low attack complexity, no privileges required, but user interaction needed.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening files with suspicious or untrusted names and apply general caution when handling files from untrusted sources.