MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit.
References
| Link | Resource |
|---|---|
| https://github.com/moos-ivp/moos-ivp | Product |
| https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/lib_logutils/SplitHandler.cpp#L608 | Issue Tracking Patch |
| https://github.com/moos-ivp/moos-ivp/commit/f684d77d9d6e9e96dbfce46f05988d5a643f2b60 | Issue Tracking Patch |
| https://github.com/moos-ivp/moos-ivp/pull/127 | Issue Tracking Patch |
| https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-alogsplit-command-injection-via-input-pathname | Third Party Advisory |
Configurations
History
14 Oct 2026, 23:28
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mit
Mit moos-ivp |
|
| References | () https://github.com/moos-ivp/moos-ivp - Product | |
| References | () https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/lib_logutils/SplitHandler.cpp#L608 - Issue Tracking, Patch | |
| References | () https://github.com/moos-ivp/moos-ivp/commit/f684d77d9d6e9e96dbfce46f05988d5a643f2b60 - Issue Tracking, Patch | |
| References | () https://github.com/moos-ivp/moos-ivp/pull/127 - Issue Tracking, Patch | |
| References | () https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-alogsplit-command-injection-via-input-pathname - Third Party Advisory | |
| CPE | cpe:2.3:a:mit:moos-ivp:*:*:*:*:*:*:*:* |
Information
Published : 2026-09-03 23:17
Updated : 2026-10-14 23:28
NVD link : CVE-2026-85439
Mitre link : CVE-2026-85439
CVE.ORG link : CVE-2026-85439
JSON object : View
Products Affected
mit
- moos-ivp
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')