Unitree Robotics Unitree Go2: OS command injection in chat_go (CVE-2026-115995)
A security vulnerability in the Unitree Go2 component chat_go allows for remote OS command injection via the set_volume function.
CVE search metadata
CVE search record: CVE-2026-115995. Severity: critical. CVSS: 9.6. KEV: no. Product: Unitree Go2 (<= 1.1.11.4). Brief: Unitree Robotics Unitree Go2: OS command injection in chat_go (CVE-2026-115995). Brief link: https://feed.craftedsignal.io/briefs/2026-10-unitree-go2-rce/
Triage facts
Revision 1- Applicability
- Unitree Go2 (<= 1.1.11.4)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Oct 25, 00:27 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A security vulnerability has been identified in the Unitree Go2 (versions up to 1.1.11.4). The vulnerability exists in the set_volume function within the gpt_thread.py file of the chat_go component. Manipulating the 'Value' argument leads to OS command injection (CWE-78). The attack can be launched remotely. The vendor has confirmed the issue via internal ticket #474.
Recommendation
- Upgrade to version 1.1.11.5, which is sufficient to resolve this issue.
Immediate actions
Upgrade Unitree Go2 firmware to 1.1.11.5