CVE-2024-42002 Unsafe use of eval() method in ros2 topic hz tool
A local attacker can execute arbitrary code via the unsanitized eval() function in the ROS 2 topic hz tool's filter option.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-42002?
CVE-2024-42002 is a high-severity code injection vulnerability in Open Source Robotics Foundation Robot Operating System 2 (ROS 2), published on 28 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.
Which versions are affected by CVE-2024-42002?
How do I fix CVE-2024-42002?
No fix has been published for CVE-2024-42002 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-42002 being exploited?
There is no known exploitation of CVE-2024-42002 in the wild and no public exploit code.