CVE-2026-85425 in iSay
Summary
by MITRE • 09/04/2026
MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY_MOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process user.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The MOOS-IvP software suite, specifically through version 24.8.1, contains a critical remote code execution vulnerability within its iSay component. This security flaw resides in the handler for the SAY_MOOS variable, which is responsible for processing incoming messages intended to be spoken aloud by the system's text-to-speech engine. The core technical deficiency lies in the failure to properly sanitize input data before it is passed to an underlying operating system shell command. By neglecting to validate or escape special characters within the message payload, the application inadvertently allows user-supplied content to be interpreted as executable code rather than static text. This represents a classic instance of OS Command Injection, where untrusted data influences the structure or execution of commands run by the application.
From an operational perspective, this vulnerability poses a severe risk to systems relying on MOOS-IvP for autonomous vehicle control or simulation environments. An attacker who can publish messages to the MOOS messaging bus with crafted SAY_MOOS content containing shell metacharacters such as backticks or command substitution syntax like dollar signs and parentheses can achieve arbitrary code execution. The severity of this impact is amplified by the fact that the iSay process typically runs with specific privileges required for audio output, meaning any executed commands will inherit these permissions. This allows an adversary to potentially compromise the integrity of the host system, exfiltrate sensitive data, or use the compromised node as a pivot point for further network attacks within the local infrastructure.
This vulnerability aligns directly with Common Weakness Enumeration identifier CWE-78, which describes Improper Neutralization of Special Elements used in an OS Command. In terms of offensive security frameworks, this exploit technique corresponds to MITRE ATT&CK tactic T1059, specifically sub-technique 004 for Unix Shell Commands. The attack vector is classified as remote because it leverages the network-accessible messaging protocol inherent to MOOS-IvP architectures, allowing exploitation without prior local access or authentication in many deployment scenarios where message publishing permissions are not strictly restricted.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary fix involves upgrading to a patched version of MOOS-IvP that addresses the input validation logic within the SAY_MOOS handler. Until an upgrade is feasible, administrators should implement strict access controls on the messaging bus to restrict who can publish messages to critical variables like SAY_MOOS. Additionally, deploying network segmentation or firewalls to limit exposure of the MOOS infrastructure to untrusted networks can reduce the attack surface. Developers reviewing similar components within the codebase should enforce a principle of least privilege and ensure that all external inputs are rigorously validated against an allowlist of expected characters before being processed by any system-level commands, thereby eliminating the possibility of command injection at the source.