{"id":"CVE-2024-39780","state":"PUBLISHED","title":"Use of unsafe yaml load in dynparam","description":"A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code.","publishedAt":"2025-04-02T07:31:57.906Z","updatedAt":"2025-06-18T10:11:42.754Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"canonical"},"assigner":"canonical","products":["Open Source Robotics Foundation Robot Operating System (ROS)"],"affected":[{"vendor":"Open Source Robotics Foundation","product":"Robot Operating System (ROS)","packageName":"dynamic_reconfigure","defaultStatus":"unaffected","versions":[{"version":"Noetic Ninjemys","status":"affected"},{"version":"Melodic Morenia","status":"affected"},{"version":"Kinetic Kame","status":"affected"},{"version":"Indigo Igloo","status":"affected"}],"modules":["dynparam"],"platforms":["Linux","Windows","MacOS"],"programFiles":["scripts/dynparam"],"repo":"https://github.com/ros/dynamic_reconfigure/"}],"references":["https://github.com/ros/dynamic_reconfigure/pull/202"],"weaknesses":["CWE-502","CWE-20"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/39xxx/CVE-2024-39780.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-39780","state":"PUBLISHED","datePublished":"2025-04-02T07:31:57.906Z","dateUpdated":"2025-06-18T10:11:42.754Z","assignerShortName":"canonical","assignerOrgId":"cc1ad9ee-3454-478d-9317-d3e869d708bc","dateReserved":"2024-08-08T14:41:22.673Z"},"containers":{"cna":{"title":"Use of unsafe yaml load in dynparam","descriptions":[{"lang":"en","value":"A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code."}],"affected":[{"vendor":"Open Source Robotics Foundation","product":"Robot Operating System (ROS)","packageName":"dynamic_reconfigure","defaultStatus":"unaffected","versions":[{"version":"Noetic Ninjemys","status":"affected"},{"version":"Melodic Morenia","status":"affected"},{"version":"Kinetic Kame","status":"affected"},{"version":"Indigo Igloo","status":"affected"}],"modules":["dynparam"],"platforms":["Linux","Windows","MacOS"],"programFiles":["scripts/dynparam"],"repo":"https://github.com/ros/dynamic_reconfigure/"}],"references":[{"url":"https://github.com/ros/dynamic_reconfigure/pull/202"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","description":"CWE-502 Deserialization of Untrusted Data","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"canonical","orgId":"cc1ad9ee-3454-478d-9317-d3e869d708bc","dateUpdated":"2025-06-18T10:11:42.754Z"},"credits":[{"lang":"en","type":"finder","value":"Florencia Cabral Berenfus, Ubuntu Robotics Team"}],"impacts":[{"capecId":"CAPEC-586","descriptions":[{"lang":"en","value":"CAPEC-586 Object Injection"}]}],"source":{"discovery":"EXTERNAL"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-02T16:17:01.985759Z","id":"CVE-2024-39780","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-02T16:20:24.302Z"}}]}}}