{"metadata": {"vulnerability": "CVE-2026-115995", "count": 25, "kinds": {"milestone": 4, "sighting": 10, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-10-24T00:00:00Z", "date_only": false, "value": "2026-10-24T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2026-115995", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-24T02:00:00Z", "date_only": false, "value": "2026-10-24T02:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2026-115995", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-24T09:17:38.081Z", "date_only": false, "value": "2026-10-24T09:17:38.081Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-115995", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-24T11:23:51Z", "date_only": false, "value": "2026-10-24T11:23:51.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2026-115995", "field": "containers.cna.timeline.2.time"}, {"timestamp": "2026-10-24T22:15:15.915Z", "date_only": false, "value": "2026-10-24T22:15:15.915Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-115995", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-24T22:15:15.915Z", "date_only": false, "value": "2026-10-24T22:15:15.915Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulDB", "record": "CVE-2026-115995", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-24T22:19:25.991Z", "date_only": false, "value": "2026-10-24T22:19:25.991727Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117498207623975817", "record": "CVE-2026-115995", "field": "creation_timestamp", "uuid": "5cfa33de-8c00-454f-9f45-822e886ac828", "content": "CVE-2026-115995 Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: \"Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78).\"\nhttps://www.cve.org/CVERecord?id=CVE-2026-115995https://vuldb.com/vuln/426093https://vuldb.com/vuln/426093/ctihttps://vuldb.com/cve/CVE-2026-115995https://vuldb.com/submit/990502https://unitree-firmware.oss-cn-hangzhou.aliyuncs.com/firmware/release/package_1.1.11.5_GO2_Edu_Max_Pro_X_1761128358872.upk#UnitreeRobotics #UnitreeGo2#CVE_2026_115995#bot", "url": "https://infosec.exchange/users/cve/statuses/117498207623975817"}, {"timestamp": "2026-10-24T23:10:04.682Z", "date_only": false, "value": "2026-10-24T23:10:04.682455Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mynstalgns2n", "record": "CVE-2026-115995", "field": "creation_timestamp", "uuid": "c7bc10c7-8537-4593-87d4-64d01fb7914a", "content": "CVE-2026-115995 - unitree go2\nThe Unitree Go2 robot (versions up to 1.1.11.4) contains a flaw in its chat_go component that lets an attacker run arbitrary system commands by manipulating the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unitreego2 #unitreerobotics #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mynstalgns2n"}, {"timestamp": "2026-10-24T23:16:58Z", "date_only": false, "value": "2026-10-24T23:16:58Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HR6G-R3R7-8H6F", "record": "GHSA-HR6G-R3R7-8H6F", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-24T23:16:58.323Z", "date_only": false, "value": "2026-10-24T23:16:58.323", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-115995", "record": "FKIE_CVE-2026-115995", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-24T23:30:18.904Z", "date_only": false, "value": "2026-10-24T23:30:18.904932Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3myntxeqxwxar", "record": "CVE-2026-115995", "field": "creation_timestamp", "uuid": "a0fa9316-62ae-4a52-a9b2-ef1f08d8311a", "content": "CVE Radar | CVE-2026-115995 | CVSS 10.0\n\nUnitree Go2 OS Command Injection\n\nCVE-2026-115995 affects Unitree Robotics Unitree Go2 versions up to 1.1.11.4.\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1330", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3myntxeqxwxar"}, {"timestamp": "2026-10-24T23:35:20.191Z", "date_only": false, "value": "2026-10-24T23:35:20.191632Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatroundup.bsky.social/post/3mynuadm2aa22", "record": "CVE-2026-115995", "field": "creation_timestamp", "uuid": "f6b1e302-13ee-43ae-ac24-28e11b9e75b6", "content": "Patch watch: CVE-2026-115995 (Unitree Robotics Unitree Go2, CVSS 9.4). A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. No public exploit reported yet. #CVE #infosec\n\nthreatroundup.com/cve/cve-2026...", "url": "https://bsky.app/profile/threatroundup.bsky.social/post/3mynuadm2aa22"}, {"timestamp": "2026-10-24T23:47:52.468Z", "date_only": false, "value": "2026-10-24T23:47:52.468118Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mynuwrubej27", "record": "CVE-2026-115995", "field": "creation_timestamp", "uuid": "195e4ea0-6438-47b6-9e08-c562e4b567fb", "content": "\ud83d\udd34 CVE-2026-115995 - Critical (9.6)\n\nA security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The im...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-115995/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mynuwrubej27"}, {"timestamp": "2026-10-25T00:00:36.056Z", "date_only": false, "value": "2026-10-25T00:00:36.056841Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117498605407619518", "record": "cve-2026-115995", "field": "creation_timestamp", "uuid": "18064422-234e-407a-aaa4-4a415cd48107", "content": "CVE-2026-115995 (CRITICAL, CVSS 9.4): OS command injection in Unitree Go2 (1.1.11.0 \u2013 1.1.11.4) enables remote code execution via set_volume in chat_go. Upgrade to 1.1.11.5 to remediate. https://radar.offseq.com/threat/cve-2026-115995-os-command-injection-in-unitree-robotics-unitree-go2-28735a7dafc55240 #OffSeq #CVE2026115995 #Robotics #Vuln", "url": "https://infosec.exchange/users/offseq/statuses/117498605407619518"}, {"timestamp": "2026-10-25T00:00:37.657Z", "date_only": false, "value": "2026-10-25T00:00:37.657007Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mynvnmmtzp2w", "record": "cve-2026-115995", "field": "creation_timestamp", "uuid": "d63fb055-d4eb-4bd0-a17b-89d7e2b1d85d", "content": "CVE-2026-115995: CRITICAL OS command injection in Unitree Go2 (v1.1.11.0 \u2013 1.1.11.4) allows remote code execution. Patch to 1.1.11.5 ASAP. \ud83d\udea8 https://radar.offseq.com/threat/cve-2026-115995-os-command-injection-in-unitree-robotics-unitree-go2-28735a7dafc55240 #OffSeq #Robotics #CVE2026115995", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mynvnmmtzp2w"}, {"timestamp": "2026-10-25T00:07:13.158Z", "date_only": false, "value": "2026-10-25T00:07:13.158392Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mynvzgarf42w", "record": "CVE-2026-115995", "field": "creation_timestamp", "uuid": "bfac48c4-a624-4da6-9f7e-90eb0b676379", "content": "\ud83d\udea8 CVE-2026-115995 \u2014 CVSS 9.4 CRITICAL\n\nA security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted ele...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-115995\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mynvzgarf42w"}, {"timestamp": "2026-10-25T00:30:59Z", "date_only": false, "value": "2026-10-25T00:30:59Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HR6G-R3R7-8H6F", "record": "GHSA-HR6G-R3R7-8H6F", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-25T00:30:59Z", "date_only": false, "value": "2026-10-25T00:30:59Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HR6G-R3R7-8H6F", "record": "GHSA-HR6G-R3R7-8H6F", "field": "modified"}, {"timestamp": "2026-10-25T09:00:26.240Z", "date_only": false, "value": "2026-10-25T09:00:26.240155Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117500728126781336", "record": "cve-2026-115995", "field": "creation_timestamp", "uuid": "364baf30-f8d1-4050-a51c-fddd180243f0", "content": "CVE-2026-115995 (CRITICAL): Unitree Go2 <1.1.11.5 has remote OS command injection in chat_go/set_volume (gpt_thread.py). Remote attackers could fully compromise systems. Upgrade to 1.1.11.5 ASAP. https://radar.offseq.com/threat/a-security-vulnerability-has-been-detected-in-unitree-robotics-unitree-go2-up-to-11114-cve-2026-115995-64c6c5b520bc3457 #OffSeq #CVE #Infosec #Robotics", "url": "https://infosec.exchange/users/offseq/statuses/117500728126781336"}, {"timestamp": "2026-10-29T15:26:42.194Z", "date_only": false, "value": "2026-10-29T15:26:42.194836Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-115995", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-29T15:26:42.194Z", "date_only": false, "value": "2026-10-29T15:26:42.194836Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-115995", "record": "FKIE_CVE-2026-115995", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-29T15:27:21.823Z", "date_only": false, "value": "2026-10-29T15:27:21.823Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-115995", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-29T15:27:21.823Z", "date_only": false, "value": "2026-10-29T15:27:21.823Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-115995", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-29T16:17:59.523Z", "date_only": false, "value": "2026-10-29T16:17:59.523", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-115995", "record": "FKIE_CVE-2026-115995", "field": "lastModified"}, {"timestamp": "2026-10-29T16:33:29.463Z", "date_only": false, "value": "2026-10-29T16:33:29.463912Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3myzoynzmfn2v", "record": "CVE-2026-115995", "field": "creation_timestamp", "uuid": "9f33c501-b75c-4d21-a623-049034fa9b71", "content": "Stopping Remote Code Execution with Sandboxes, CVE-2026-115995: Rust Zip", "url": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3myzoynzmfn2v"}], "metrics": {"as_of": "2026-10-31T01:21:18.154Z", "anchors": {"origin": {"timestamp": "2026-10-24T22:15:15.915Z", "date_only": false, "value": "2026-10-24T22:15:15.915Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-115995", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-24T22:15:15.915Z", "date_only": false, "value": "2026-10-24T22:15:15.915Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-115995", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 529562.239855, "hours": 147.10062218194446, "days": 6.129192590914353, "min_seconds": 529562.239855, "max_seconds": 529562.239855, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-24T22:15:15.915Z", "date_only": false, "value": "2026-10-24T22:15:15.915Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-115995", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-31T01:21:18.154Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}