CVE-2026-109097: Code Injection
A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary code into the generated program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ROS#to a version that resolves this vulnerability.Fixed in V2.3.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
ROS# installations running versions earlier than V2.3.1 are affected when a user processes a message definition file that an attacker can influence or supply.
What does an attacker need to exploit it?
The attacker needs a way to provide a crafted message definition file to a user and have that file used to generate a program. User interaction is required.
What is the potential impact?
Improper escaping of message-definition text can allow arbitrary code to be injected into the generated program, with high impact to confidentiality, integrity, and availability.
What should teams do if they cannot patch immediately?
Do not process message definition files from untrusted or attacker-controlled sources. Restrict who can supply such files and review them before they are used for program generation.