Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-115995: Unitree Go2 allows remote command execution via set_volume
CVE-2026-115995 · published 10 days ago
Summary
The Unitree Go2 robot (versions up to 1.1.11.4) contains a flaw in its chat_go component that lets an attacker run arbitrary system commands by manipulating the volume setting. This can be triggered from a distance without physical access. Updating the robot to version 1.1.11.5 fixes the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unitree robotics | unitree go2 | 1.1.11.0 |
Original advisory text
Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-78OS Command Injection
CWE-77Command Injection
Timeline
Published24 Oct 2026
Updated3 Nov 2026
First seen24 Oct 2026
Track software like this
Free during beta