resolwe (>=36.0.0a1, <=40.0.0), resolwe-bio (>=0.0.0, <=57.0.1) potentially affected by CVE-2025-24359 via asteval (0.9.29)

asteval PYPI version 0.9.29 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - resolwe =36.0.0a1, =0.0.0, =57.0.1 Source cves: CVE-2025-24359 Source advisory: OSV:PYSEC-2026-1195...

kalkon (>=0.1.0, <=0.4.0) potentially affected by CVE-2025-24359 via asteval (0.9.31)

asteval PYPI version 0.9.31 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - kalkon =0.1.0, =0.4.0 Source cves: CVE-2025-24359 Source advisory: OSV:PYSEC-2026-1195...

agent-smith-ai (>=0.9.2, <=1.0.1), bibliomancer (0.1.0) +24 more potentially affected by CVE-2025-24359 via asteval (0.9.33)

asteval PYPI version 0.9.33 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - agent-smith-ai =0.9.2, =0.2.0rc0, =0.1.0, =0.2.0, =0.1.0, =2.1.3, =2.1.0b2, =2.5.1, =0.4.0, =0.1.4, =0.7.0, =0.3.0, =0.5.0 and more Source cves:...

awslabs-ccapi-mcp-server (>=1.0.1, <=1.0.18), bridgecrew (>=3.2.415, <=3.2.477) +10 more potentially affected by CVE-2025-24359 via asteval (1.0.5)

asteval PYPI version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - awslabs-ccapi-mcp-server =1.0.1, =3.2.415, =3.2.415, =0.1.130, =6.0.0, =5.8.0, =5.8.0, =0.0.8, =0.1.0, =0.31.0 Source cves: CVE-2025-24359 Source...

ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape

SummaryIf an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. DetailsThe vulnerability is rooted in how asteval performs handling of FormattedValue AST nodes. In...

ROOT-APP-PYPI-CVE-2025-24359 CVE-2025-24359 in rootio-asteval - Patched by Root

Root has patched CVE-2025-24359 in the rootio-asteval package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-VP47-9734-PRJW GHSA-vp47-9734-prjw in rootio-asteval - Patched by Root

Root has patched GHSA-vp47-9734-prjw in the rootio-asteval package for Root:PyPI. Multiple fixed versions available...

PT-2025-54760

Root has patched GHSA-vp47-9734-prjw in the rootio-asteval package for Root:PyPI. Multiple fixed versions available...

OESA-2025-2558 python-asteval security update

ASTEVAL provides a numpy-aware, safeish 'eval' function Security Fixes: ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the asteval library, they can bypass asteval s restrictions and execute arbitrary Python code in th...

Fedora: Security Advisory (FEDORA-2025-99d252d8fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

asteval Race Situation Code Execution

The vulnerability of the asteval programming language library is related to synchronization errors when using a shared resource „Race Situation“. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

[SECURITY] Fedora 42 Update: python-asteval-1.0.6-1.fc42

ASTEVAL is a safeish evaluator of Python expressions and statements, using Python's ast module. The idea is to provide a simple, safe, and robust miniature mathematical language that can handle user-input. The emphasis here is on mathematical expressions, and so many functions from numpy are...

Fedora: Security Advisory (FEDORA-2025-83c141f000)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 42 : python-asteval (2025-83c141f000)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-83c141f000 advisory. Fix CVE-2025-24359 closes rhbz2341976 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Fedora 43 : python-asteval (2025-99d252d8fc)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-99d252d8fc advisory. Automatic update for python-asteval-1.0.6-1.fc43. Changelog Wed Jul 9 2025 Fabian Affolter - 1.0.6-1 - Update to latest upstream release closes rhbz2338907 -...

OESA-2025-1298 python-asteval security update

ASTEVAL provides a numpy-aware, safeish 'eval' function Emphasis is on mathematical expressions, and so numpy ufuncs are used if available. Symbols are held in the Interpreter symbol table 'symtable': a simple dictionary supporting a simple, flat namespace. Expressions can be compiled into ast no...

asteval 1.06 Arbitrary Code Execution / Sandbox Escape Vulnerabilities

An attacker who can pass input to the asteval library, when this is used with numpy functions in the symbol table the default setting, can bypass restrictions and execute arbitrary code as the user who ran the python process. Versions 1.06 and below are affected. CVE pending Sandboxing Python is...

asteval 1.06 Arbitrary Code Execution / Sandbox Escape

An attacker who can pass input to the asteval library, when this is used with numpy functions in the symbol table the default setting, can bypass restrictions and execute arbitrary code as the user who ran the python process. Versions 1.06 and below are affected. CVE pending Sandboxing Python is...

Linux Distros Unpatched Vulnerability : CVE-2025-24359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the asteval library, they can bypa...

openSUSE Security Advisory (openSUSE-SU-2025:0052-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...