PT-2025-29951 · Unknown+1 · Robot Operating System+1

Published 2025-07-17 · Updated 2025-07-18 · CVE-2024-39835

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Robot Operating System (ROS) versions prior to Noetic Ninjemys

Description A code injection issue exists in the 'roslaunch' command-line tool due to the use of the eval() method to process unsanitized parameter values within the substitution args mechanism. This allows attackers to execute arbitrary Python code.

Recommendations Update to a version of Robot Operating System (ROS) newer than Noetic Ninjemys.

Fix

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

CVE-2024-39835

Affected Products

Debian

Robot Operating System

References · 11

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-39835 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39835 · Security Note
• https://ubuntu.com/security/CVE-2024-39835 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-39835 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-39835 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-39835 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1946034830887522481 · Twitter Post
• https://t.me/cvenotify/129369 · Telegram Post
• https://twitter.com/CVEnew/status/1945932472396734929 · Twitter Post
• https://ros.org/blog/noetic-eol · Note