CVE-2024-41148 Details
Description
A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.
A code injection vulnerability exists in the Robot Operating System (ROS) 'rostopic' command-line tool, impacting ROS distributions Noetic Ninjemys and earlier. The issue arises in the 'hz' verb, which reports the publishing rate of a topic. The vulnerability allows local users to execute arbitrary code by injecting a user-provided Python expression through the --filter option, as this input is directly passed to the eval() function without any sanitization.
Users are encouraged to migrate to ROS 2, as ROS 1 Noetic will reach end-of-life on May 31, 2025. Migration guides for ROS 2 Humble Hawksbill and ROS 2 Jazzy Jalisco are available. For complex ROS 1 systems, the ROS 1 to ROS 2 Bridge can be used to migrate one package at a time.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.ros.org/blog/noetic-eol/ | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openrobotics robot operating system | indigo_igloo kinetic_kame melodic_morenia noetic_ninjemys |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 26, 2025 | Initial Analysis | [email protected] |
| Jul 17, 2025 | New CVE Received | [email protected] |