CVE-2026-85439

MOOS-IvP through 24.8.1 contains an OS command injection flaw (CWE-78) in the alogsplit utility's SplitHandler::handlePreCheckSplitDir() function, which passes log file pathnames to the shell without sanitizing shell metacharacters. An attacker triggers the flaw by embedding shell syntax in a log file name or in the --dir parameter that alogsplit processes; although described as remote code execution, the CVSS 4.0 vector rates the attack vector as local, meaning the attacker must influence the pathname alogsplit handles. Successful exploitation yields execution of arbitrary commands with the privileges of the operator running alogsplit, which can compromise the workstation or analysis pipeline. Users are operators running alogsplit from MOOS-IvP deployments, typically academic and research groups working with unmanned marine vehicle autonomy software. There is no known exploitation in the wild, no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days.

What to do: Upgrade to a MOOS-IvP release newer than 24.8.1 once a patched version is available. Until then, avoid running alogsplit on log file names or --dir values that could be attacker-controlled, and ensure pathnames are validated or safely quoted before reaching the shell. Check any automated pipelines that feed externally sourced log names into alogsplit, and run the tool under a least-privilege account.