CVE-2026-41551

CriticalCVSS 9.1

Published: 12/05/2026(UTC)Updated: 24/10/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.64%

50th percentile - higher than 50% of all known CVEs

Summary

A vulnerability has been identified in ROS# (All versions < V2.2.2) related to path traversal due to improper sanitization of user input. This could allow a remote attacker to access arbitrary files on the device.

Risk Assessment

This vulnerability poses a risk of unauthorized access to sensitive data on the device, potentially leading to serious security breaches.

Recommendation

It is recommended to update ROS# to version 2.2.2 or later to mitigate this vulnerability and implement proper input sanitization mechanisms.

Other vulnerabilities in ROS#

CVE-2024-42002High
A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.

Original NVD description (English source)

A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerability because user input is not properly sanitized. This could allow a remote attacker to access arbitrary files on the device.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS