rovr EUVD-2026-99017

Exploitation requires a Windows installation of rovr ≤0.10.3 and a victim who opens an attacker-controlled file through rovr's open_file function; the file name must contain Windows shell metacharacters (such as '&') that are passed unquoted to cmd.exe. The attacker must first get the maliciously-named file onto a location the victim browses (download, network share, archive extraction, removable media) - this is a local attack vector, not remote/network. Limiting factors: active user interaction is mandatory (the user must select/open the crafted file), exploitation is Windows-specific, it is constrained to versions ≤0.10.3, and the injected command runs only with the invoking user's existing privileges (no elevation or scope change).

The CVSS 4.0 base score of 8.4 (High) is driven almost entirely by the High confidentiality, integrity, and availability impacts (VC:H/VI:H/VA:H) of arbitrary command execution, but the exploitability metrics substantially temper real-world risk: the attack vector is LOCAL (AV:L), not network, and active user interaction is required (UI:A) - the victim must actually open a maliciously-named file inside rovr. There is no EPSS score, no CISA KEV listing, and no explicitly flagged public exploit in the provided data, so there is no public exploit identified at time of analysis; however, a detailed VulnCheck advisory and a HackMD technical writeup plus specific vulnerable source lines (path.py) are referenced, meaning exploitation details are effectively public even if a packaged exploit is not confirmed. Crucially, execution occurs only with the invoking user's privileges (SC/SI/SA:N, no scope change), so there is no privilege escalation. Weighing these signals together, this is a genuine command-injection flaw but a low aggregate priority for most organizations: a high-CVSS issue in a niche hobby product that requires local file placement and user action, rather than a widespread remotely-exploitable threat. The CVSS PR:N (unauthenticated) combined with AV:L/UI:A is internally consistent with a 'malicious file opened by a user' model.

An attacker crafts a file whose name contains Windows shell metacharacters (e.g. '&') alongside a command payload and delivers it to a target (via download, shared folder, archive, or USB). When the victim browses to and opens that file through rovr's open_file path on Windows, the unquoted name is passed to cmd.exe and the embedded command executes with the victim's privileges. No packaged public exploit is confirmed, but VulnCheck and a HackMD writeup publicly document the technique and the vulnerable code.