A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.
PUBLISHED5.2CWE-95CWE-94
Unsafe use of eval() method in ros2 topic hz tool
Problem type
- CWE-95 Improper neutralization of directives in dynamically evaluated code ('eval injection')
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products
Open Source Robotics Foundation
Robot Operating System 2 (ROS 2)
Rolling Ridley - AFFECTED
Lyrical Luth - AFFECTED
Kilted Kaiju - AFFECTED
Jazzy Jalisco - AFFECTED
Iron Irwini - AFFECTED
Humble Hawksbill - AFFECTED
Galactic Geochelone - AFFECTED
Foxy Fitzroy - AFFECTED
Eloquent Elusor - AFFECTED
Dashing Diademata - AFFECTED
Crystal Clemmys - AFFECTED
References
github.com
https://github.com/ros2/ros2cli/pull/1001
github.com
https://github.com/ros2/ros2cli/pull/133#discussion_r223081766
JSON source
https://cveawg.mitre.org/api/cve/CVE-2024-42002Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-42002",
"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"assignerShortName": "canonical",
"dateUpdated": "2026-09-28T21:38:08.369Z",
"dateReserved": "2024-08-01T12:00:12.183Z",
"datePublished": "2026-09-28T21:38:08.369Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"shortName": "canonical",
"dateUpdated": "2026-09-28T21:38:08.369Z"
},
"title": "Unsafe use of eval() method in ros2 topic hz tool",
"descriptions": [
{
"lang": "en",
"value": "A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code."
}
],
"affected": [
{
"vendor": "Open Source Robotics Foundation",
"product": "Robot Operating System 2 (ROS 2)",
"packageName": "ros2topic",
"modules": [
"ros2topic"
],
"programFiles": [
"ros2topic/ros2topic/verb/hz.py"
],
"platforms": [
"Linux",
"MacOS",
"Windows"
],
"repo": "https://github.com/ros2/ros2cli",
"defaultStatus": "unaffected",
"versions": [
{
"version": "Rolling Ridley",
"status": "affected",
"versionType": "custom"
},
{
"version": "Lyrical Luth",
"status": "affected",
"versionType": "custom"
},
{
"version": "Kilted Kaiju",
"status": "affected",
"versionType": "custom"
},
{
"version": "Jazzy Jalisco",
"status": "affected",
"versionType": "custom"
},
{
"version": "Iron Irwini",
"status": "affected",
"versionType": "custom"
},
{
"version": "Humble Hawksbill",
"status": "affected",
"versionType": "custom"
},
{
"version": "Galactic Geochelone",
"status": "affected",
"versionType": "custom"
},
{
"version": "Foxy Fitzroy",
"status": "affected",
"versionType": "custom"
},
{
"version": "Eloquent Elusor",
"status": "affected",
"versionType": "custom"
},
{
"version": "Dashing Diademata",
"status": "affected",
"versionType": "custom"
},
{
"version": "Crystal Clemmys",
"status": "affected",
"versionType": "custom"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-95 Improper neutralization of directives in dynamically evaluated code ('eval injection')",
"cweId": "CWE-95",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"description": "CWE-94 Improper Control of Generation of Code ('Code Injection')",
"cweId": "CWE-94",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/ros2/ros2cli/pull/1001",
"tags": [
"patch"
]
},
{
"url": "https://github.com/ros2/ros2cli/pull/133#discussion_r223081766",
"tags": [
"issue-tracking"
]
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH"
}
}
],
"workarounds": [
{
"lang": "en",
"value": "Do not pass untrusted or unreviewed input to the --filter option of 'ros2 topic hz'."
}
],
"solutions": [
{
"lang": "en",
"value": "No fixed release is available at the time of publication. A fix is proposed upstream in https://github.com/ros2/ros2cli/pull/1001."
}
],
"credits": [
{
"lang": "en",
"value": "Florencia Cabral Berenfus, Ubuntu Robotics Team",
"type": "finder"
}
]
}
}
}