Code Injection Vulnerability in Robot Operating System's Command-Line Tool

CVE-2024-39835

What is CVE-2024-39835?

A code injection flaw has been discovered in the 'roslaunch' command-line tool of the Robot Operating System (ROS), which affects several distributions including Noetic Ninjemys and earlier versions. This vulnerability stems from the improper handling of user-supplied parameters in the eval() method, enabling attackers to introduce and execute arbitrary Python code. By exploiting this flaw through crafted parameter inputs, an adversary could potentially gain unauthorized control over the system and compromise its integrity, thus posing a significant risk to applications leveraging ROS for robotic frameworks and automation.

References