CVE-2024-39289: Unsafe use of eval() method in rosparam tool

Q: What is the severity of CVE-2024-39289?

CVE-2024-39289 is classified as a high severity code execution vulnerability.

Q: How do I fix CVE-2024-39289?

To fix CVE-2024-39289, upgrade to a later version of the Robot Operating System that does not include the vulnerability.

Q: What versions of Robot Operating System are affected by CVE-2024-39289?

CVE-2024-39289 affects the Robot Operating System Noetic Ninjemys and earlier versions.

Q: What causes the CVE-2024-39289 vulnerability?

The CVE-2024-39289 vulnerability is caused by the use of the eval() function to process unsanitized user-supplied parameter values.

Q: Are there any known exploits for CVE-2024-39289?

There are currently no specific exploits publicly available for CVE-2024-39289.

Published Jul 17, 2025

Updated

A code execution vulnerability has been discovered in the Robot Operating System (ROS) 'rosparam' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability stems from the use of the eval() function to process unsanitized, user-supplied parameter values via special converters for angle representations in radians. This flaw allowed attackers to craft and execute arbitrary Python code.

Affected Software

5 affected components

Open Robotics Robot Operating System<Noetic Ninjemys

Openrobotics Robot Operating System=indigo_igloo

Openrobotics Robot Operating System=kinetic_kame

Openrobotics Robot Operating System=melodic_morenia

Openrobotics Robot Operating System=noetic_ninjemys

Remediation

Information

All ROS (1) versions are EOL, upgrade to a ROS 2 version.

Event History

Jul 17, 2025

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-39289?

CVE-2024-39289 is classified as a high severity code execution vulnerability.

How do I fix CVE-2024-39289?