TI-2020-08296 Aliases CVE-2020-10289 GHSA-2x5j-2j53-xffv

RVD#2401: Use of unsafe yaml load, ./src/actionlib/tools/library.py:132

MEDIUM 42CWE-20Published 2020-08-20 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-502.

Summary

Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib, an attacker with local or remote access can make the ROS Master, execute arbitrary code in Python form. Consider yaml.safe_load() instead. Located first in actionlib/tools/library.py:132. See links for more info on the bug.

Why it matters now

EPSS 0.01975 80th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Open Source Robotics Foundation	ros	ROS Melodic Morenia and prior distros	—	No fix listed	CNA

ros VendorOpen Source Robotics Foundation Affected ROS Melodic Morenia and prior distros Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:o:openrobotics:robot_operating_system:-:::::::*	not specified by NVD	Vulnerable	Open Source Robotics Foundation

cpe:2.3:o:openrobotics:robot_operating_system:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Open Source Robotics Foundation

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-10289
2026-10-03 Alias added: GHSA-2x5j-2j53-xffv

References

Patch 1

https://github.com/ros/actionlib/pull/171

TI-2024-27715 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2… CVSS 3.1CRITICAL 9.8
TI-2024-27712 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2… CVSS 3.1CRITICAL 9.8
TI-2024-27711 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2… CVSS 3.1CRITICAL 9.8
TI-2024-27710 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2… CVSS 3.1CRITICAL 9.8
TI-2024-26110 Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered… CVSS 3.1CRITICAL 9.8
TI-2024-26109 Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered… CVSS 3.1CRITICAL 9.8

See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences