OS Command Injection in Unitree Robotics Unitree Go2 Device
CVE-2026-115995

9.4CRITICAL

Key Information:

Vendor

Unitree Robotics

Status
Unitree Go2
Vendor
CVE Published:
24 October 2026

What is CVE-2026-115995?

A security flaw in the Unitree Robotics Unitree Go2, specifically within the chat_go component's set_volume function, allows for potential OS command injection. This vulnerability facilitates remote attacks by manipulating input parameters, posing a risk to the integrity of the system. Users are advised to upgrade to version 1.1.11.5 to mitigate this risk, as this update addresses the identified vulnerabilities effectively. The vendor has acknowledged the issue, confirming it through their internal tracking system, emphasizing the importance of prompt action to secure affected devices.

Affected Version(s)

Unitree Go2 1.1.11.0

Unitree Go2 1.1.11.1

Unitree Go2 1.1.11.2

References

https://vuldb.com/vuln/426093
vdb-entrytechnical-description
https://vuldb.com/vuln/426093/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-115995
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

JasperXJY (VulDB User)
VulDB CNA Team
.