Rovr version 0.10.3 on Windows contains an OS command injection flaw that lets an attacker run arbitrary commands by creating files with shell metacharacters. The vulnerability arises when the application opens files using an unquoted path to cmd.exe, causing the injected payload to execute with the current user's privileges. This leads to loss of confidentiality, integrity, and availability as the attacker can run any system command.

The affected product is Rovr, maintained by NSPC911, specifically the 0.10.3 release for Windows. No other versions are known to be impacted based on the current data.

The CVSS score of 8.4 indicates a high severity. The EPSS score of 1% indicates a low but non-zero likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker supplying a maliciously named file to the target system; when a user or a process opens the file through the open_file function, the unquoted path to cmd.exe executes the injected payload. The exploit requires a supply of the crafted file but does not need elevated privileges beyond the user’s rights, making it potentially exploitable in local or remote contexts where file upload or user interaction occurs.