Code Injection Vulnerability in Robot Operating System's Command-Line Tool

CVE-2024-41148

What is CVE-2024-41148?

A serious code injection vulnerability has been found in the 'rostopic' command-line tool of the Robot Operating System (ROS). This issue affects ROS distributions, including Noetic Ninjemys and those released prior. The vulnerability arises from the 'hz' command, which reports a topic's publishing rate and allows the use of a user-provided Python expression through the --filter option. Since the input is passed directly to the eval() function without appropriate sanitization, local users could exploit this to craft and execute arbitrary code, posing significant security risks.

References