CVE-2026-115995 Details
Description
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."
An OS command injection vulnerability has been identified in Unitree Robotics Unitree Go2 versions prior to 1.1.11.5. The issue arises in the chat_go component, specifically within the set_volume function of gpt_thread.py. This vulnerability can be exploited remotely by manipulating the Value argument, leading to unauthorized command execution on the operating system.
Users are advised to upgrade to Unitree Robotics Unitree Go2 version 1.1.11.5 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 24, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/submit/990502 | CISA-ADP | Issue TrackingPermission Required |
| https://unitree-firmware.oss-cn-hangzhou.aliyuncs.com/firmware/release/package_1.1.11.5_GO2_Edu_Max_Pro_X_1761128358872.upk | [email protected] | Broken LinkVendor |
| https://vuldb.com/cve/CVE-2026-115995 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/990502 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/426093 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/426093/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Unitree Robotics Unitree Go2 | <= 1.1.11.4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 24, 2026 | New CVE Received | [email protected] |