Robot Operating System Code Injection Vulnerability in rostopic Command-Line Tool

A code injection vulnerability exists in the Robot Operating System (ROS) 'rostopic' command-line tool, impacting ROS distributions Noetic Ninjemys and earlier. The issue arises in the 'hz' verb, which reports the publishing rate of a topic. The vulnerability allows local users to execute arbitrary code by injecting a user-provided Python expression through the --filter option, as this input is directly passed to the eval() function without any sanitization.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the local system.

Remediation

Users are encouraged to migrate to ROS 2, as ROS 1 Noetic will reach end-of-life on May 31, 2025. Migration guides for ROS 2 Humble Hawksbill and ROS 2 Jazzy Jalisco are available. For complex ROS 1 systems, the ROS 1 to ROS 2 Bridge can be used to migrate one package at a time.