Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2026-115995

Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection

En bref

Sévérité
CRITICAL 9.4
EPSS
EPSS 1.38 % · centile 72 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
VulDB
Statut NVD
Deferred

Description

A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."

Scores

VersionScoreVecteurÉvalué par
CVSS 4.0CRITICAL 9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:XVulDB
CVSS 3.1CRITICAL 9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:X/RL:O/RC:CVulDB
CVSS 3.0CRITICAL 9.6CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:X/RL:O/RC:CVulDB
CVSS 2.0CRITICAL 10.0AV:N/AC:L/Au:N/C:C/I:C/A:C/E:ND/RL:OF/RC:CVulDB
CVSS 4.0CRITICAL 9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · cna@vuldb.com (Secondary)
CVSS 3.1CRITICAL 9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HNVD · cna@vuldb.com (Primary)
CVSS 2.0HIGH 10.0AV:N/AC:L/Au:N/C:C/I:C/A:CNVD · cna@vuldb.com (Secondary)

Faiblesses (CWE)

Références européennes

Produits affectés

ProduitVersions
Unitree Robotics · Unitree Go2affected 1.1.11.0 ; affected 1.1.11.1 ; affected 1.1.11.2 ; affected 1.1.11.3 ; affected 1.1.11.4 ; unaffected 1.1.11.5

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD