CVE-2026-85439 in MOOS-IvP
Summary
by MITRE • 09/04/2026
MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified within MOOS-IvP versions up to 24.8.1 represents a critical remote code execution flaw located specifically within the SplitHandler::handlePreCheckSplitDir() function associated with the alogsplit utility. This component is responsible for managing log file splitting operations, which are essential for maintaining system health and debugging in autonomous underwater vehicle platforms that rely on this middleware. The core technical deficiency lies in the failure to properly sanitize shell metacharacters present within log file pathnames or arguments passed via the --dir parameter. When the application processes these inputs, it constructs command-line strings without adequate validation or escaping of special characters such as semicolons, pipes, ampersands, and backticks. This lack of input sanitization allows an attacker to inject arbitrary shell syntax directly into the execution context of the alogsplit process.
From a technical perspective, this flaw constitutes a classic Command Injection vulnerability, formally categorized under CWE-78 in the Common Weakness Enumeration standard. The mechanism of exploitation relies on the application's tendency to pass unsanitized user-controlled data directly to system-level shell interpreters or command execution functions. By embedding malicious payloads within log file names or directory paths, an attacker can break out of the intended parameter boundaries and execute additional commands. For instance, if a log filename contains a sequence like ; rm -rf /, the underlying shell will interpret this not as part of a filename but as distinct commands to be executed sequentially. This behavior bypasses any application-level logic that might otherwise restrict operations to standard file management tasks.
The operational impact of this vulnerability is severe due to the privilege level at which it operates. The alogsplit utility typically runs with the privileges of the operator or user account launching the MOOS-IvP applications, rather than as a restricted service account. Consequently, successful exploitation grants an attacker full command execution capabilities under that specific user context. This can lead to complete compromise of the host system, including unauthorized access to sensitive data, installation of backdoors, pivoting to other networked systems, or disruption of critical autonomous vehicle operations. In maritime environments where MOOS-IvP is frequently deployed, such a breach could jeopardize mission integrity and physical safety if control over navigation or sensor data pipelines is compromised through system-level manipulation.
Mitigation strategies must address both immediate remediation and long-term secure coding practices. The primary solution involves upgrading to patched versions of MOOS-IvP where this input validation issue has been resolved by developers implementing strict allow-listing for file paths and proper escaping mechanisms before shell execution. In the interim, organizations should enforce least-privilege principles by running alogsplit under dedicated service accounts with minimal permissions, thereby limiting the blast radius of any potential exploitation. Additionally, input validation layers should be implemented at the application boundary to reject or sanitize special characters in log file names and directory parameters. Security teams are advised to monitor for anomalous process executions originating from logging utilities as part of their threat detection efforts aligned with MITRE ATT&CK techniques related to command and script interpretation.