CVE-2024-39289CWE-94CWE-95

Unsafe use of eval() method in rosparam tool

High · published July 17, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
10.4
In the wild
Unconfirmed
What it is

A code execution vulnerability has been discovered in the Robot Operating System (ROS) 'rosparam' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability stems from the use of the eval() function to process unsanitized, user-supplied parameter values via special converters for angle representations in radians. This flaw allowed attackers to craft and execute arbitrary Python code.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00208 · 10.4th percentile
Weaknesses
CWE-94 · Improper Control of Generation of Code ('Code Injection'); CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2025-07-17T19:11Z
EPSS history
Timeline
  • 17 JUL 19:11Z
    Unsafe use of eval() method in rosparam tool
    cvelistv5