CVE-2024-39780

A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - security@ubuntu.com

Published

2025-04-02

Last modified

2025-06-18

Weaknesses

CWE-20, CWE-502

Affected products

• Robot Operating System Ros (Open Source Robotics Foundation)
• Robot Operating System (Openrobotics)

References

• https://github.com/ros/dynamic_reconfigure/pull/202