TI-2024-26748 Aliases CVE-2024-39835 GHSA-627q-xcr8-8qpc

Unsafe use of eval() method in roslaunch tool

LOW 35CWE-94Published 2025-07-17 · Updated 2025-07-18

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

A code injection vulnerability has been identified in the Robot Operating System (ROS) 'roslaunch' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() method to process user-supplied, unsanitized parameter values within the substitution args mechanism, which roslaunch evaluates before launching a node. This flaw allows attackers to craft and execute arbitrary Python code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00203 10th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Open Source Robotics Foundation	Robot Operating System (ROS)	Noetic Ninjemys; Melodic Morenia; Kinetic Kame; Indigo Igloo	—	No fix listed	CNA

Robot Operating System (ROS) VendorOpen Source Robotics Foundation Affected Noetic Ninjemys; Melodic Morenia; Kinetic Kame; Indigo Igloo Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:o:openrobotics:robot_operating_system:indigo_igloo:::::::*	indigo_igloo	Vulnerable	Open Source Robotics Foundation
cpe:2.3:o:openrobotics:robot_operating_system:kinetic_kame:::::::*	kinetic_kame	Vulnerable	Open Source Robotics Foundation
cpe:2.3:o:openrobotics:robot_operating_system:melodic_morenia:::::::*	melodic_morenia	Vulnerable	Open Source Robotics Foundation
cpe:2.3:o:openrobotics:robot_operating_system:noetic_ninjemys:::::::*	noetic_ninjemys	Vulnerable	Open Source Robotics Foundation

cpe:2.3:o:openrobotics:robot_operating_system:indigo_igloo:*:*:*:*:*:*:* Versions indigo_igloo Vulnerable ·Open Source Robotics Foundation
cpe:2.3:o:openrobotics:robot_operating_system:kinetic_kame:*:*:*:*:*:*:* Versions kinetic_kame Vulnerable ·Open Source Robotics Foundation
cpe:2.3:o:openrobotics:robot_operating_system:melodic_morenia:*:*:*:*:*:*:* Versions melodic_morenia Vulnerable ·Open Source Robotics Foundation
cpe:2.3:o:openrobotics:robot_operating_system:noetic_ninjemys:*:*:*:*:*:*:* Versions noetic_ninjemys Vulnerable ·Open Source Robotics Foundation

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-39835
2026-10-03 Alias added: GHSA-627q-xcr8-8qpc

References

Other 1

https://www.ros.org/blog/noetic-eol/

TI-2024-27715 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2… CVSS 3.1CRITICAL 9.8
TI-2024-27712 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2… CVSS 3.1CRITICAL 9.8
TI-2024-27711 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2… CVSS 3.1CRITICAL 9.8
TI-2024-27710 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2… CVSS 3.1CRITICAL 9.8
TI-2024-26110 Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered… CVSS 3.1CRITICAL 9.8
TI-2024-26109 Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered… CVSS 3.1CRITICAL 9.8

See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences