A critical code execution vulnerability exists in the ROS rosbag tool, which could allow an attacker to execute arbitrary Python code on the host system.

This is an eval injection vulnerability (CWE-95) triggered by the rosbag filter command. The tool processes unsanitized, user-supplied input through an eval() function, allowing local attackers to achieve arbitrary code execution.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running the rosbag tool. Given the CVSS score of 7.8, this poses a high risk to system integrity and confidentiality, potentially leading to full system compromise or unauthorized access to robotics control data.

Immediate Action: As all affected ROS 1 distributions are end of life, users must migrate to a supported ROS 2 version to receive security updates and support.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected Python subprocesses spawned by the rosbag utility.

Compensating Controls: Restrict access to the rosbag tool and ensure that only trusted users can execute filter commands on sensitive data sets.

Public Exploit Available: Unknown.

This vulnerability represents a significant security risk for environments utilizing legacy ROS 1 distributions. Because these versions are no longer officially supported, the only viable path to remediation is a migration to ROS 2. System administrators should prioritize this migration to ensure long-term security and eliminate the risk of exploitation.