moos-ivp npm Package Remote Code Execution Vulnerability
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- moos-ivp (npm)
- Affected versions
- >= v24.8.1, <= v24.8.1
- Patched version
- Not yet available
The moos-ivp npm package version 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler. Attackers can execute arbitrary commands as the iSay process user.
What happened
The moos-ivp npm package version 24.8.1 has been confirmed to contain a remote code execution vulnerability. This vulnerability exists in the SAY_MOOS variable handler, which passes unsanitized text to a shell command. Attackers can exploit this by publishing SAY_MOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process user.
This vulnerability was first flagged on 2026-09-03T23:17:21.337000+00:00 and confirmed on 2026-09-04T00:12:19.449406+00:00. The CVSS score is 9.8, indicating a critical severity level.
To assess your exposure, check if your system uses moos-ivp version 24.8.1. If so, you are affected and should take immediate action to upgrade to a version that fixes the vulnerability.
What to do about it
- Upgrade to a version of moos-ivp that fixes the vulnerability and sanitizes input to the SAY_MOOS variable handler.
- Review your system for any instances where moos-ivp version 24.8.1 is used and replace it with a secure version.
- Monitor the primary sources for updates on patched versions and additional mitigation advice.
How 0Day would have caught this
moos-ivp is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if your system uses moos-ivp version 24.8.1.
What should I do right now?
Upgrade to a version of moos-ivp that fixes the vulnerability and sanitizes input to the SAY_MOOS variable handler.
Has this been exploited in the wild?
No, this vulnerability has not been exploited in the wild according to the provided data.