# CVE-2026-85439: MOOS-IvP alogsplit command injection in handlePreCheckSplitDir

Source: https://junglewise.ai/threats/cve-2026-85439-moos-ivp-alogsplit-command-injection-in-handleprechecksplitdir  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85439 · Severity: high · CVSS 7.8 · Published 2026-09-03

MOOS-IvP is a software framework for autonomous robotic platforms, particularly marine vehicles. The alogsplit utility, used to process and split log files, contains a command injection vulnerability in its path handling that allows attackers to execute arbitrary commands with the privileges of the operator running the tool by embedding shell metacharacters in log file paths or directory parameters.

Technologies: [MOOS-IvP](https://junglewise.ai/threats/technologies/moos-ivp). Vendors: [MOOS-IvP](https://junglewise.ai/threats/vendors/moos-ivp).

## Quick answers

**Is CVE-2026-85439 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85439 being exploited in the wild.

**How severe is CVE-2026-85439?** High severity, with a CVSS score of 7.8, published 3 September 2026.

**Which products and versions are affected?** MOOS-IvP through 24.8.1.

**Is there a fix for CVE-2026-85439?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85439 attacked?** It is attacked over the network or with local access.

**Am I affected by CVE-2026-85439?** Check whether you run MOOS-IvP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the SplitHandler::handlePreCheckSplitDir() function within alogsplit, which fails to properly sanitize shell metacharacters in log file pathnames and the --dir parameter. Attackers can exploit this via a network or local vector by providing specially crafted log file names or directory paths containing shell syntax (e.g., semicolons, pipes, command substitution). The unsanitized input is passed to shell execution functions, allowing remote code execution with the privileges of the alogsplit operator. No special authentication or user interaction is required beyond providing a malicious input path. Patches should be available in versions after 24.8.1.

## Affected products

- MOOS-IvP MOOS-IvP through 24.8.1

## Timeline

- 2026-09-03: disclosed

## References

- [https://github.com/moos-ivp/moos-ivp](https://github.com/moos-ivp/moos-ivp)
- [https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/lib_logutils/SplitHandler.cpp](https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/lib_logutils/SplitHandler.cpp)

## Related threats

- [MOOS-IvP path traversal in SplitHandler variable validation](https://junglewise.ai/threats/cve-2026-85456-moos-ivp-path-traversal-in-splithandler-variable-validation)
- [MOOS-IvP quadratic processing vulnerability in uFldNodeComms](https://junglewise.ai/threats/cve-2026-85446-moos-ivp-quadratic-processing-vulnerability-in-ufldnodecomms)
- [MOOS-IvP Demuxer denial of service via unbounded memory allocation](https://junglewise.ai/threats/cve-2026-85445-moos-ivp-demuxer-denial-of-service-via-unbounded-memory)
- [MOOS-IvP buffer over-read in string parsing functions](https://junglewise.ai/threats/cve-2026-85444-moos-ivp-buffer-over-read-in-string-parsing-functions)
- [MOOS-IvP buffer overflow in StringToIvPFunction](https://junglewise.ai/threats/cve-2026-85438-moos-ivp-buffer-overflow-in-stringtoivpfunction)