CVE-2026-115995 is a critical OS command injection vulnerability in the chat_go component of Unitree Robotics Unitree Go2 firmware up to version 1.1.11.4, fixed in version 1.1.11.5.
What Is It
CVE-2026-115995 is in the set_volume function of gpt_thread.py, which is part of the Go2's chat_go component. If an attacker controls the Value argument, they can inject operating system commands. VulDB is the CNA that assigned the CVE. Its record classifies the flaw as CWE-77 (Command Injection) and CWE-78 (OS Command Injection) and says the attack can be launched remotely.
The vendor confirmed the issue early. It stated that VulDB submission 990502 matches its internal ticket #474, which it describes as "Go2 chat_go set_volume OS command injection, CWE-78."
NVD published the record on 2026-10-24. Its status is currently "Received," so NVD has not yet completed its own analysis.
Why It Matters
The CNA rates this flaw as critical across every CVSS version provided:
- CVSS 3.1: 9.6 Critical (
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). The attack works over the network, has low complexity, needs no privileges and requires user interaction. Scope is changed, and confidentiality, integrity and availability impact are all high. - CVSS 4.0: 9.4 Critical. Network attack vector, no privileges required, passive user interaction, and high impact on both the vulnerable system and subsequent systems.
- CVSS 2.0: 10.0.
A successful attack could let someone run arbitrary OS commands on an affected robot.
Exploitation status: None of the sources cited here report active exploitation. The CVSS 4.0 exploit maturity field is "Not Defined."
What's Vulnerable
- Vendor: Unitree Robotics
- Product: Unitree Go2
- Component:
chat_go(functionset_volume, filegpt_thread.py) - Affected versions: 1.1.11.0, 1.1.11.1, 1.1.11.2, 1.1.11.3, 1.1.11.4
- Unaffected version: 1.1.11.5
- CPE:
cpe:2.3:a:unitree_robotics:unitree_go2:*:*:*:*:*:*:*:*
Patch Status
A fix is available. According to the CVE description, upgrading to version 1.1.11.5 is enough to resolve the issue, and users should upgrade the affected component. The CNA's references include a link to the 1.1.11.5 firmware package for Go2 Edu/Max/Pro/X.