Unitree Go2 CVE-2026-115995 advisory: chat_go set_volume command injection

Evidence record

Unitree Go2 CVE-2026-115995 advisory: chat_go set_volume command injection

Read the original source ↗

Claim-level citations (2)

• supportsUnitree Go2 chat volume parameter could cross into shell execution: The Unitree Go2 advisory attributes OS command injection to the chat_go gpt_thread.py set_volume Value argument, lists releases through 1.1.11.4 as affected, and identifies 1.1.11.5 as the vendor fix.

  CVE-2026-115995, description and vendor ticket 474

• supportsUnitree Go2 chat volume parameter could cross into shell execution: The GitHub advisory describes attacker-influenced set_volume values reaching a shell in the Go2 chat software, lists affected releases up to 1.1.11.4 and names 1.1.11.5 as fixed.

  CVE-2026-115995 description, chat_go/gpt_thread.py set_volume path and patched versions