Arbitrary Code Execution Vulnerability in python-asteval Package
Summary
DEBIAN-CVE-2025-24359: ASTEVAL is an evaluator of Python expressions and statements. Affects python-asteval versions < 1.0.6-2. Fixed in 1.0.6-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-asteval package is a library designed for evaluating Python expressions and statements safely. It allows developers to execute Python code within a controlled environment, making it useful for applications that require dynamic code evaluation. However, prior to version 1.0.6, the library had a significant vulnerability that could be exploited if an attacker could manipulate the input to the library, leading to potential security breaches.
Vulnerability Detail
The vulnerability arises from the way the python-asteval library handles FormattedValue AST nodes. Specifically, the on_formattedvalue method utilizes the dangerous format method of the str class, which can be exploited by an attacker. By controlling the input, an attacker can trigger an AttributeError exception, allowing them to access protected attributes and execute arbitrary Python code in the context of the application. This poses a severe risk as it can lead to unauthorized access to sensitive data and system compromise.
How To Fix
Minimum fixed version
1.0.6-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-astevalTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround is to sanitize and validate all inputs to the python-asteval library to prevent untrusted data from being processed. This can help mitigate the risk of exploitation until the package can be updated.
Conclusion
The python-asteval package has a critical vulnerability that allows for arbitrary code execution if an attacker can control the input. It is essential to update to the patched version 1.0.6-2 or later to mitigate this risk. Additionally, implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for python-asteval →
FAQ
python-asteval is a library that allows for the evaluation of Python expressions and statements, providing a controlled environment for dynamic code execution.
If your application uses an affected version of python-asteval, an attacker could exploit the vulnerability to execute arbitrary code, potentially compromising sensitive data and system integrity.
Versions prior to 1.0.6 are affected by this vulnerability. It is crucial to update to version 1.0.6-2 or later to ensure security.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, ensure that all inputs to the python-asteval library are sanitized and validated to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-asteval.
