Code Execution Vulnerability in Robot Operating System Tool by Open Robotics

CVE-2024-39289

What is CVE-2024-39289?

A code execution vulnerability exists in the 'rosparam' tool of the Robot Operating System (ROS), which affects several ROS distributions, including Noetic Ninjemys and earlier versions. This vulnerability arises from the unsafe implementation of the eval() function, allowing attackers to exploit unsanitized user-input parameter values, particularly through specialized converters for angle representations in radians. By leveraging this flaw, an attacker can execute arbitrary Python code on vulnerable systems, posing a significant security risk.

References