CVE-2024-39835: Unsafe use of eval() method in roslaunch tool

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-17 · updated 2026-06-17
Weakness: CWE-94

Description

A code injection vulnerability has been identified in the Robot Operating System (ROS) 'roslaunch' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() method to process user-supplied, unsanitized parameter values within the substitution args mechanism, which roslaunch evaluates before launching a node. This flaw allows attackers to craft and execute arbitrary Python code.

Affected products

Open Source Robotics Foundation Robot Operating System (ROS): indigo_igloo, kinetic_kame, melodic_morenia, noetic_ninjemys

References

https://www.ros.org/blog/noetic-eol/

Get alerted when CVE-2024-39835 or the next vulnerability affects your stack