rovr: OS command injection via crafted file names on Windows

Summary

rovr through version 0.10.3 is a terminal file manager that contains an OS command injection vulnerability on Windows. An attacker can create a file whose name contains shell metacharacters such as & together with a payload. When the user opens such a file through the open_file function, the injected commands run with the user's privileges. The attacker must get the crafted file to the user and the user must open it in rovr.

Affected

• rovr 0 through 0.10.3 on Windows (CNA range; VulDB lists 0.10.0, 0.10.1, 0.10.2 and 0.10.3)
• Earlier versions are not confirmed as unaffected
• Other platforms are not described as affected

Fixed in

Unknown.

• The OSV record lists 0.10.3 as fixed, but 0.10.3 is itself listed as affected, so this is likely a data error.
• No patched version has been confirmed by the vendor.

Workaround

• No vendor-documented workaround is available.
• Avoid opening files from untrusted or downloaded folders with rovr on Windows.
• Open suspicious files with a different tool.

Exploitation

• CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'total'.
• No evidence of exploitation in the wild has been found.
• No public exploit has been verified; the reporter's analysis was static and not confirmed at runtime on native Windows.
• EPSS score is low (0.01146).

Our recommendation

• Check whether rovr is installed on Windows devices (pip, uv, pipx, scoop or standalone binary).
• Remove rovr from workstations where it is not needed, or switch to another file manager until a fix is confirmed.
• Where rovr stays in use, instruct users not to open files from untrusted sources with it.
• Monitor the upstream repository for a release that explicitly fixes this issue.
• Priority: low to medium; higher on developer or administrator machines.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• OSV record osv.dev
• VulnCheck advisory www.vulncheck.com
• rovr release v0.10.3 github.com
• rovr path.py (affected code, lines 115-158) github.com
• VulDB entry vuldb.com
• Strix CVE record (CNA mirror) www.strix.ai
• PyPI rovr 0.10.3 pypi.org
• HackMD reporter writeup hackmd.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:32.