Security Digest: October 25, 2026 - 1 Critical Vulnerability

Today’s alert is focused on a single critical remote command injection flaw in Unitree Robotics’ Go2 platform. If you run affected versions of chat_go, you should treat this as an urgent patching event and move to version 1.1.11.5 immediately.

· 4 min read

Executive Summary

Today’s alert is focused on a single critical remote command injection flaw in Unitree Robotics’ Go2 platform. If you run affected versions of chat_go, you should treat this as an urgent patching event and move to version 1.1.11.5 immediately.

The issue can be triggered remotely through the set_volume function in gpt_thread.py, allowing an attacker to execute operating system commands. Until patched, assume exposed systems are at high risk of takeover.

Critical Vulnerabilities

CVE-2026-115995: Remote OS Command Injection in Unitree Go2 chat_go

  • Impact: An attacker can manipulate the Value argument in set_volume to trigger remote OS command injection. This can lead to arbitrary command execution on the affected device.
  • Affected Systems: Unitree Robotics Unitree Go2 running chat_go up to and including 1.1.11.4.
  • Immediate Action: Upgrade to version 1.1.11.5 now. Prioritize any internet-facing, remotely accessible, or operationally critical units first. If you cannot patch immediately, isolate the device from untrusted networks and restrict access to the chat_go component.
  • Mitigation: Apply the vendor fix in 1.1.11.5 as soon as possible. Validate that the updated package is deployed across all affected robots and remove any temporary network exposure used for testing or support.

What to Do Now

  1. Patch immediately: Upgrade all affected Unitree Go2 systems to 1.1.11.5.
  2. Reduce exposure: Disconnect or segment any unit that cannot be patched right away.
  3. Verify versioning: Confirm no production or lab systems remain on 1.1.11.4 or earlier.
  4. Check for abuse: Review logs for unexpected set_volume requests, abnormal command execution, or unexplained process activity.
  5. Harden access: Limit who can reach the affected service and ensure only trusted management networks can communicate with the device.

Verification steps:

  • Inventory all Unitree Go2 devices and identify those running chat_go.
  • Confirm installed build numbers against 1.1.11.5.
  • Test that the patched version is active after deployment and that the vulnerable component is no longer exposed externally.

Monitoring recommendations:

  • Alert on unusual requests to set_volume or repeated parameter tampering.
  • Watch for new shells, spawned processes, or unexpected system commands on the robot.
  • Monitor network traffic to and from Go2 units for suspicious remote interaction patterns.

Related Resources

  • Internal blog posts: Add a short internal advisory on Unitree Go2 patch validation and exposure review.
  • Official vendor advisories: Unitree Robotics security notice for Submission 990502 / internal ticket #474 covering the chat_go set_volume OS command injection issue (CWE-78).

Keep reading