CVE-2024-42002— Unsafe use of eval() method in ros2 topic hz tool
Quick assessment
Affected
Open Source Robotics Foundation Robot Operating System 2 (ROS 2)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在机器人操作系统 2（ROS 2）的“ros2topic”命令行工具中发现了一种代码注入漏洞，该漏洞影响从 Crystal Clemmys 到 Lyrical Luth（含）以及 Rolling Ridley 的所有 ROS 2 发行版。漏洞存在于“hz”子命令中，该子命令用于报告主题的发布频率，并通过 --filter 选项接受用户提供的 Python 表达式。该输入未经过任何清理直接传递给 eval() 函数，从而导致本地用户可以构造并执行任意代码。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-42002
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unsafe use of eval() method in ros2 topic hz tool
Source: CVE Program / CVE List V5
Vulnerability Description
A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
动态执行代码中指令转义处理不恰当(Eval注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Open Source Robotics Foundation | Robot Operating System 2 (ROS 2) | Rolling Ridley | - |
|
II. Public POCs for CVE-2024-42002
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-42002
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-42002 (2)
IV. Related Vulnerabilities
Same vendor: Open Source Robotics Foundation
-
CVE-2025-3753
Unsafe use of eval() method in rosbag tool -
CVE-2024-41921
Unsafe use of eval() method in rostopic echo tool -
CVE-2024-41148
Unsafe use of eval() method in rostopic hz tool -
CVE-2024-39835
Unsafe use of eval() method in roslaunch tool -
CVE-2024-39289
Unsafe use of eval() method in rosparam tool
Same weakness: CWE-95
-
CVE-2026-101861
Langflow Code Execution via eval() in Component Input Schema -
CVE-2026-100741
Improper Neutralization of Directives in Dynamically Evaluat -
CVE-2026-100842
MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox B -
CVE-2026-100840
MONAI through 1.6.0 Remote Code Execution via bundle configu -
CVE-2026-57149
plone.app.portlets Vulnerable to Remote Code Execution via T
V. Comments for CVE-2024-42002
No comments yet