CVE-2025-24359

Summary

CVE-2025-24359 is a vulnerability affecting the ASTEVAL library before version 1.0.6. This issue enables attackers to bypass the library's restrictions and execute arbitrary Python code, exploiting a weakness in how `ASTEVAL` handles `FormattedValue` AST nodes. The root cause lies within the use of the dangerous `format` method from the `str` class in the `on_formattedvalue` value. An attacker can manipulate the string used in this method call, allowing them to trigger an `AttributeError` exception and gain unauthorized access to sensitive or protected object properties. The vulnerability is fixed in version 1.0.6.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.