CVE-2024-42002
CVSS v3
8.4
HIGH
EPSS Score
0.2 %
exploit probability, as of 2026-09-29
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and exe
Technical details
- CVSS v3 Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published
- 2026-09-28
- Last Modified
- 2026-09-29
Frequently asked questions
What is CVE-2024-42002?
A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and exe
Is CVE-2024-42002 actively exploited?
Active exploitation of CVE-2024-42002 has not been confirmed. Its EPSS score was 0.2% on 2026-09-29, the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2024-42002?
CVE-2024-42002 has a CVSS v3 base score of 8.4 (HIGH severity), with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Is CVE-2024-42002 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2024 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).