CVE-2026-76639: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Unitree Robotics G1 EDU

CVE-2026-76639 describes an unauthenticated remote code execution vulnerability in Unitree Robotics G1 EDU firmware versions through 1.5.2. The exploit chain leverages an unauthenticated WebRTC-to-DDS bridge listening on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, use path traversal to plant a malicious payload in the script execution directory, and trigger execution of this payload as root via the bashrunner shell subprocess.

Successful exploitation allows a network-adjacent attacker to execute arbitrary commands with root privileges on the affected device without any authentication. This compromises the device's integrity and control, potentially allowing full system takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented. Until a patch is available, restrict network access to TCP port 9991 and monitor for suspicious DDS control messages if possible.