Robot Operating System
Approved changes feed: RSS · Atom
cpe:2.3:o:openrobotics:robot_operating_system:melodic_morenia:*:*:*:*:*:*:*
part: o version: melodic_morenia update: *
| Vendor | Openrobotics (a5b2c799-61c2-5657-93f5-fde4560d0687) |
|---|---|
| Product | Robot Operating System (5b36adaf-5fab-5f1e-9275-ccafee54a5b6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/ros |
purl2cpe | 2026-06-01 10:18:20.637499 |
pkg:github/ros-infrastructure/www.ros.org |
purl2cpe | 2026-06-01 10:18:20.637501 |
pkg:github/ros/ros |
purl2cpe | 2026-06-01 10:18:20.637503 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-3753 |
vulnerable | 2026-06-08 07:23:09.775015 |
Unsafe use of eval() method in rosbag tool
HIGH (7.8)
A code execution vulnerability has been identified in the Robot Operating System (ROS) 'rosbag' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() function to process unsanitized, user-supplied input in the 'rosbag filter' command. This flaw enables attackers to craft and execute arbitrary Python code.
Published: 2025-07-17T19:14:20.486Z
Updated: 2025-07-18T08:05:27.171Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41921 |
vulnerable | 2026-06-08 06:43:55.463765 |
Unsafe use of eval() method in rostopic echo tool
HIGH (7.8)
A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'echo' verb, which allows a user to introspect a ROS topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.
Published: 2025-07-17T19:13:34.025Z
Updated: 2025-07-18T08:05:08.288Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41148 |
vulnerable | 2026-06-08 06:43:54.093342 |
Unsafe use of eval() method in rostopic hz tool
HIGH (7.8)
A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.
Published: 2025-07-17T19:12:54.440Z
Updated: 2025-07-18T08:04:55.109Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39835 |
vulnerable | 2026-06-08 06:41:51.716264 |
Unsafe use of eval() method in roslaunch tool
HIGH (7.8)
A code injection vulnerability has been identified in the Robot Operating System (ROS) 'roslaunch' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() method to process user-supplied, unsanitized parameter values within the substitution args mechanism, which roslaunch evaluates before launching a node. This flaw allows attackers to craft and execute arbitrary Python code.
Published: 2025-07-17T19:12:08.177Z
Updated: 2025-07-18T08:04:28.875Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39780 |
vulnerable | 2026-06-08 06:41:51.596266 |
Use of unsafe yaml load in dynparam
HIGH (7.8)
A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code.
Published: 2025-04-02T07:31:57.906Z
Updated: 2025-06-18T10:11:42.754Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39289 |
vulnerable | 2026-06-08 06:41:48.976511 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.