Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-85425, describes a remote code execution flaw in MOOS-IvP's iSay component, specifically within the SAY_MOOS variable handler. The core issue is the unsanitized passing of user-controlled text to a shell command. Analysis of the provided commit ed3a44131fd3e5528602f20adc37ba82273c1cd8 reveals that the ivp/src/iSay/Sayer.cpp file was modified to address this. Prior to the patch, the Sayer::sayUtterance function constructed a command string (cmd) by concatenating various input elements, some of which could be influenced by an attacker via SAY_MOOS messages. This cmd string was then directly passed to the system() function. The system() function executes its argument via the operating system's shell, which means any special characters (e.g., backticks, semicolons, $(...)) within the cmd string would be interpreted by the shell, allowing for command injection. The patch introduces a new helper function, runNoShell, which uses fork() and execvp() to execute commands directly from an argument vector, completely bypassing the shell's interpretation. The Sayer::sayUtterance function was modified to use this safer runNoShell function instead of the vulnerable system() call. Therefore, Sayer::sayUtterance is identified as the vulnerable function because it was the direct caller of the system() function with attacker-controlled input, leading to the command injection.
Sayer::sayUtteranceivp/src/iSay/Sayer.cpp