Code Injection Vulnerability in Robot Operating System's Command-Line Tool

CVE-2024-41921

What is CVE-2024-41921?

A code injection vulnerability has been identified in the Robot Operating System (ROS) related to its 'rostopic' command-line tool. Specifically, the issue is linked to the 'echo' verb, which permits a user to introspect a ROS topic. The tool's '--filter' option accepts a user-defined Python expression that is subsequently passed to the eval() function without any form of input sanitization. This oversight empowers local users to craft and execute arbitrary code, posing significant security risks to systems running affected versions of the Robot Operating System.

References