SECURITYCRITICALCVE-2026-115995

CVE-2026-115995: OS Command Injection in Unitree Go2 Robot chat_go Component

A remotely exploitable OS command injection in Unitree Go2's set_volume function (versions up to 1.1.11.4) carries a CVSS score of 9.6.

Dylan H.

Security Team

October 25, 2026
2 min read
CVE-2026-115995: OS Command Injection in Unitree Go2 Robot chat_go Component

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Unitree Robotics Unitree Go2 up to 1.1.11.4

Executive Summary

CVE-2026-115995 is an OS command injection vulnerability in Unitree Robotics Unitree Go2 up to version 1.1.11.4. The flaw is in the set_volume function of gpt_thread.py in the chat_go component. Manipulating the Value argument leads to OS command injection, and the attack can be launched remotely.

CVSS Score: 9.6 (Critical)

Vulnerability Details

FieldValue
CVE IDCVE-2026-115995
CVSS Score9.6 (Critical)
Weakness ClassOS Command Injection
Attack VectorNetwork (Remote)
Published2026-10-24

Impact

A successful attack could allow arbitrary commands to run on the robot's onboard computer, with the potential for control of the device, access to its sensors such as cameras and microphones, and a foothold on the network it is attached to.

Remediation

  1. Check Unitree for a firmware release newer than 1.1.11.4 and apply it when available.
  2. Keep Go2 units on an isolated network segment and do not expose them to the internet.
  3. Disable or restrict the chat_go voice and AI features if they are not needed.
  4. Restrict which hosts can reach the robot's services.

References