Vulnerability record/PUBLISHED/Published Oct 24, 2026 22:15:15 UTC
CVE-2026-115995
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."
Base score9.4/ 10
SeverityCriticalCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityCritical
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionPassiveUI
Vulnerable system confidentialityHighVC
Vulnerable system integrityHighVI
Vulnerable system availabilityHighVA
Subsequent system confidentialityHighSC
Subsequent system integrityHighSI
Subsequent system availabilityHighSA
Exploit maturityNot definedE
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:XCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulDB
Last updatedOct 24, 2026 22:15:15 UTC
PublishedOct 24, 2026 22:15:15 UTC
ReservedOct 24, 2026 09:17:38 UTC
Credits
- JasperXJY (VulDB User)
- VulDB CNA Team