Read the docs
TI-2024-28019 Aliases CVE-2024-42002

Unsafe use of eval() method in ros2 topic hz tool

Priority LOW 38CWE-94Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0016 5th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Open Source Robotics FoundationRobot Operating System 2 (ROS 2)Rolling Ridley; Lyrical Luth; Kilted Kaiju; Jazzy Jalisco; Iron Irwini; Humble Hawksbill; Galactic Geochelone; Foxy Fitzroy; Eloquent Elusor; Dashing Diademata; Crystal Clemmys—No fix listedCNA
  • Robot Operating System 2 (ROS 2) VendorOpen Source Robotics Foundation Affected Rolling Ridley; Lyrical Luth; Kilted Kaiju; Jazzy Jalisco; Iron Irwini; Humble Hawksbill; Galactic Geochelone; Foxy Fitzroy; Eloquent Elusor; Dashing Diademata; Crystal Clemmys Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-42002

References

Patch 1

Other 1

  • TI-2024-27715 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2… CVSS 3.1CRITICAL 9.8
  • TI-2024-27712 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2… CVSS 3.1CRITICAL 9.8
  • TI-2024-27711 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2… CVSS 3.1CRITICAL 9.8
  • TI-2024-27710 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2… CVSS 3.1CRITICAL 9.8
  • TI-2024-26110 Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered… CVSS 3.1CRITICAL 9.8
  • TI-2024-26109 Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered… CVSS 3.1CRITICAL 9.8
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences