A critical code injection vulnerability exists in multiple end-of-life versions of the Robot Operating System (ROS) that permits attackers to execute arbitrary Python code.

This flaw stems from the use of the eval() function on unsanitized, user-supplied input within the roslaunch substitution args mechanism. Because this evaluation occurs before node initialization, an attacker can trigger arbitrary Python code execution through the command-line tool.

Successful exploitation allows an attacker to achieve full control over the execution environment of the ROS node. Given the CVSS score of 7.8, this vulnerability poses a high risk to operational integrity, potentially leading to unauthorized system access, data exfiltration, or the disruption of critical robotic processes.

Immediate Action: All affected versions of ROS (ROS 1) have reached their end-of-life status. Organizations must migrate to a supported ROS 2 distribution to receive ongoing security updates and patches.

Proactive Monitoring: Monitor system logs for unusual command-line arguments or unexpected child processes spawned by roslaunch. Review all launch files for suspicious parameter inputs that may attempt to inject malicious syntax.

Compensating Controls: Implement strict access controls for the environment where ROS nodes are executed to ensure that only authorized users can initiate launch commands. Use network-level segmentation to isolate robotic systems from untrusted networks.

Public Exploit Available: No (exploit_available: false)

The reliance on end-of-life software components presents an unmitigated risk that cannot be resolved through standard patching. We strongly recommend an immediate transition to a supported ROS 2 environment, as the current architecture of ROS 1 contains fundamental flaws that are no longer being addressed by the vendor.