CVE-2025-24359

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-24359
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-24359.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-24359
Aliases
Related
Published
2025-01-24T17:15:16Z
Modified
2025-02-13T05:45:31.065972Z
Summary
[none]
Details

ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is rooted in how asteval performs handling of FormattedValue AST nodes. In particular, the on_formattedvalue value uses the dangerous format method of the str class. The code allows an attacker to manipulate the value of the string used in the dangerous call fmt.format(__fstring__=val). This vulnerability can be exploited to access protected attributes by intentionally triggering an AttributeError exception. The attacker can then catch the exception and use its obj attribute to gain arbitrary access to sensitive or protected object properties. Version 1.0.6 fixes this issue.

References

Affected packages

Debian:11 / python-asteval

Package

Name
python-asteval
Purl
pkg:deb/debian/python-asteval?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.9.19-2
0.9.25-1
0.9.25-2
0.9.28-1
0.9.30-1
0.9.31-1

1.*

1.0.6-1
1.0.6-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / python-asteval

Package

Name
python-asteval
Purl
pkg:deb/debian/python-asteval?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.9.28-1
0.9.30-1
0.9.31-1

1.*

1.0.6-1
1.0.6-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / python-asteval

Package

Name
python-asteval
Purl
pkg:deb/debian/python-asteval?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.6-2

Affected versions

0.*

0.9.28-1
0.9.30-1
0.9.31-1

1.*

1.0.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}