ZeroDay Findings
Sign inSign up

Findings

CVE-2026-85425

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command.

Published Sep 3, 2026 · updated Oct 14, 2026 · mit moos-ivp

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY_MOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process user.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 3, 2026 · NIST NVD

    Detected

    MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY_MOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process user.

  2. Oct 14, 2026 · NIST NVD

    Updated

    MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY_MOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process user.

Affected

  • cpe mit/moos-ivpversion unspecified

Sources

  • CVE.orgCVE-2026-85425

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2026-85425

    MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY_MOOS messages containing backticks or command substitution syntax to execute arbitrary commands

    nvd.nist.gov

References