CVE-2026-115995 — Unitree Go2 update fixes remotely reachable command injection

41/100

CVE-2026-115995 affects Unitree Robotics Unitree Go2 through version 1.1.11.4 and permits remote OS command injection through the chat_go component's set_volume function. Version 1.1.11.5 resolves the issue.

• CVSS 9.4
• CWE-77

Digest of 2026-10-26

Sources

• NVD — critical CVEs (CVSS ≥ 9) — CVE-2026-115995 (CVSS 9.4)