CVE-2024-42002

High

Description

A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.

SeverityHigh

CVSS8.4

Exploit probability—

ProductRobot Operating System 2 (ROS 2)

PublishedSep 28, 2026

First seenSep 28, 2026

Weakness typeCWE-95CWE-95 CWE-94Code injection

How to fix

Patches

github.com/ros2/ros2cli/pull/1001

Affected products

Product	Affected versions	Fixed in
Open Source Robotics Foundation Robot Operating System 2 (ROS 2)	Rolling Ridley, Lyrical Luth, Kilted Kaiju, Jazzy Jalisco, Iron Irwini, Humble Hawksbill, Galactic Geochelone, Foxy Fitzroy, Eloquent Elusor, Dashing Diademata, Crystal Clemmys	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.