# CVE-2026-109097 - ROS# Code Injection Vulnerability

DevFeed: [CVE-2026-109097 - ROS# Code Injection Vulnerability](<https://devfeed.tech/articles/cve-2026-109097-ros-code-injection-vulnerability-125785.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-109097>)

Author: CVEFEED.io; siemens.com

Published: 2026-11-10T12:17:16Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [Code](<https://devfeed.tech/topics/code.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [code-injection](<https://devfeed.tech/tags/code-injection.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-109097](<https://devfeed.tech/tags/cve-2026-109097.md>), [ros](<https://devfeed.tech/tags/ros.md>), [siemens](<https://devfeed.tech/tags/siemens.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

ROS# versions before 2.3.1 do not properly escape text in message definition files. An attacker able to provide a crafted definition file could inject arbitrary code into the generated program. The excerpt rates the vulnerability 8.6 (HIGH); it gives no mitigation or remediation details.

## Source excerpt

CVE ID :CVE-2026-109097 Published : Nov. 10, 2026, 12:17 p.m. | 14 minutes ago Description :A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary code into the generated program. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...