Skip to content
Critical OS Command Injection Vulnerability in Unitree Go2 Robots

Critical OS Command Injection Vulnerability in Unitree Go2 Robots

First seen 25 Oct 2026, 16:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 25, 2026 at 18:13 UTC
  • •CVE-2026-115995 is a critical OS command injection vulnerability in Unitree Go2 robots.
  • •The vulnerability allows remote execution of arbitrary OS commands with user interaction.
  • •A patch is available in version 1.1.11.5; no exploitation has been reported yet.

A critical OS command injection vulnerability (CVE-2026-115995) has been discovered in the Unitree Go2 robot, affecting versions up to 1.1.11.4. The flaw resides in the set_volume function of the gpt_thread.py file, allowing unauthenticated attackers to execute arbitrary OS commands remotely with user interaction. The CVSS score for this vulnerability is 9.6, indicating a critical severity level. A patch has been released in version 1.1.11.5, which fully resolves the issue. There are currently no reports of exploitation in the wild or public proof-of-concept code. Security experts recommend upgrading to the latest version and restricting network access to mitigate risks. The vulnerability was first published on October 24, 2026, and has been confirmed by multiple sources.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-24
CVE-2026-115995 published
The vulnerability was disclosed with a CVSS score of 9.6, indicating critical severity.
Feedly
2026-10-25
Patch released for Unitree Go2
Unitree Robotics released version 1.1.11.5 to fix the OS command injection vulnerability.
radar.offseq.com
2026-10-25
CVE-2026-116207 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (5)

Following this threat?

Track Unitree Robotics and CVE-2026-115995 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 4

Common questions

Which versions of Unitree Go2 are affected?
Versions up to 1.1.11.4 are affected by the OS command injection vulnerability.
Is there a patch available?
Yes, a patch has been released in version 1.1.11.5 to address the vulnerability.
Have there been any reports of exploitation?
No, there are currently no reports of exploitation in the wild for this vulnerability.