https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 26 Jun 2026 21:41:03 +0000 https://vulnerability.circl.lu/sighting/9935a1d8-9899-4a71-99f4-f46bd8d25be1/export {"uuid": "9935a1d8-9899-4a71-99f4-f46bd8d25be1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-24359", "type": "published-proof-of-concept", "source": "https://github.com/lmfit/asteval/security/advisories/GHSA-3wwr-3g9f-9gc7", "content": "", "creation_timestamp": "2025-01-24T01:56:30.000000Z"} {"uuid": "9935a1d8-9899-4a71-99f4-f46bd8d25be1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-24359", "type": "published-proof-of-concept", "source": "https://github.com/lmfit/asteval/security/advisories/GHSA-3wwr-3g9f-9gc7", "content": "", "creation_timestamp": "2025-01-24T01:56:30.000000Z"} https://vulnerability.circl.lu/sighting/9935a1d8-9899-4a71-99f4-f46bd8d25be1/export Fri, 24 Jan 2025 01:56:30 +0000 https://vulnerability.circl.lu/sighting/45d3a28f-71ca-4cf8-b170-671b28757a29/export {"uuid": "45d3a28f-71ca-4cf8-b170-671b28757a29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24359", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113884373894073837", "content": "", "creation_timestamp": "2025-01-24T16:53:59.708415Z"} {"uuid": "45d3a28f-71ca-4cf8-b170-671b28757a29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24359", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113884373894073837", "content": "", "creation_timestamp": "2025-01-24T16:53:59.708415Z"} https://vulnerability.circl.lu/sighting/45d3a28f-71ca-4cf8-b170-671b28757a29/export Fri, 24 Jan 2025 16:53:59 +0000 https://vulnerability.circl.lu/sighting/4bfbe826-a6b7-4f33-8651-4b28d160cc5a/export {"uuid": "4bfbe826-a6b7-4f33-8651-4b28d160cc5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24359", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/2936", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-24359\n\ud83d\udd39 Description: ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is rooted in how `asteval` performs handling of `FormattedValue` AST nodes. In particular, the `on_formattedvalue` value uses the dangerous format method of the str class. The code allows an attacker to manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)`. This vulnerability can be exploited to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. Version 1.0.6 fixes this issue.\n\ud83d\udccf Published: 2025-01-24T16:52:44.304Z\n\ud83d\udccf Modified: 2025-01-24T16:52:44.304Z\n\ud83d\udd17 References:\n1. https://github.com/lmfit/asteval/security/advisories/GHSA-3wwr-3g9f-9gc7\n2. https://github.com/lmfit/asteval/blob/cfb57f0beebe0dc0520a1fbabc35e66060c7ea71/asteval/asteval.py#L507\n3. https://lucumr.pocoo.org/2016/12/29/careful-with-str-format", "creation_timestamp": "2025-01-24T17:04:48.000000Z"} {"uuid": "4bfbe826-a6b7-4f33-8651-4b28d160cc5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24359", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/2936", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-24359\n\ud83d\udd39 Description: ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is rooted in how `asteval` performs handling of `FormattedValue` AST nodes. In particular, the `on_formattedvalue` value uses the dangerous format method of the str class. The code allows an attacker to manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)`. This vulnerability can be exploited to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. Version 1.0.6 fixes this issue.\n\ud83d\udccf Published: 2025-01-24T16:52:44.304Z\n\ud83d\udccf Modified: 2025-01-24T16:52:44.304Z\n\ud83d\udd17 References:\n1. https://github.com/lmfit/asteval/security/advisories/GHSA-3wwr-3g9f-9gc7\n2. https://github.com/lmfit/asteval/blob/cfb57f0beebe0dc0520a1fbabc35e66060c7ea71/asteval/asteval.py#L507\n3. https://lucumr.pocoo.org/2016/12/29/careful-with-str-format", "creation_timestamp": "2025-01-24T17:04:48.000000Z"} https://vulnerability.circl.lu/sighting/4bfbe826-a6b7-4f33-8651-4b28d160cc5a/export Fri, 24 Jan 2025 17:04:48 +0000 https://vulnerability.circl.lu/sighting/956d10d9-aa9e-4c03-8977-98f9b3db572f/export {"uuid": "956d10d9-aa9e-4c03-8977-98f9b3db572f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24359", "type": "seen", "source": "https://mastodon.social/users/CyberSignaler/statuses/113884588529521871", "content": "", "creation_timestamp": "2025-01-24T17:48:36.693214Z"} {"uuid": "956d10d9-aa9e-4c03-8977-98f9b3db572f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24359", "type": "seen", "source": "https://mastodon.social/users/CyberSignaler/statuses/113884588529521871", "content": "", "creation_timestamp": "2025-01-24T17:48:36.693214Z"} https://vulnerability.circl.lu/sighting/956d10d9-aa9e-4c03-8977-98f9b3db572f/export Fri, 24 Jan 2025 17:48:36 +0000 https://vulnerability.circl.lu/sighting/767ab6c8-8432-44ea-9f90-860c39e3b1cd/export {"uuid": "767ab6c8-8432-44ea-9f90-860c39e3b1cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24359", "type": "seen", "source": "https://t.me/cvedetector/16305", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2025-24359 - ASTEVAL Arbitary Code Execution Vulnerability\", \n \"Content\": \"CVE ID : CVE-2025-24359 \nPublished : Jan. 24, 2025, 5:15 p.m. | 44\u00a0minutes ago \nDescription : ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is rooted in how `asteval` performs handling of `FormattedValue` AST nodes. In particular, the `on_formattedvalue` value uses the dangerous format method of the str class. The code allows an attacker to manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)`. This vulnerability can be exploited to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. Version 1.0.6 fixes this issue. \nSeverity: 8.4 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"24 Jan 2025\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-24T19:25:33.000000Z"} {"uuid": "767ab6c8-8432-44ea-9f90-860c39e3b1cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24359", "type": "seen", "source": "https://t.me/cvedetector/16305", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2025-24359 - ASTEVAL Arbitary Code Execution Vulnerability\", \n \"Content\": \"CVE ID : CVE-2025-24359 \nPublished : Jan. 24, 2025, 5:15 p.m. | 44\u00a0minutes ago \nDescription : ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is rooted in how `asteval` performs handling of `FormattedValue` AST nodes. In particular, the `on_formattedvalue` value uses the dangerous format method of the str class. The code allows an attacker to manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)`. This vulnerability can be exploited to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. Version 1.0.6 fixes this issue. \nSeverity: 8.4 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"24 Jan 2025\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-24T19:25:33.000000Z"} https://vulnerability.circl.lu/sighting/767ab6c8-8432-44ea-9f90-860c39e3b1cd/export Fri, 24 Jan 2025 19:25:33 +0000 https://vulnerability.circl.lu/sighting/128cda0f-7327-44ad-9539-22726c1a69ab/export {"uuid": "128cda0f-7327-44ad-9539-22726c1a69ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24359", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3luadors6zs24", "content": "", "creation_timestamp": "2025-07-18T11:27:35.886909Z"} {"uuid": "128cda0f-7327-44ad-9539-22726c1a69ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-24359", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3luadors6zs24", "content": "", "creation_timestamp": "2025-07-18T11:27:35.886909Z"} https://vulnerability.circl.lu/sighting/128cda0f-7327-44ad-9539-22726c1a69ab/export Fri, 18 Jul 2025 11:27:35 +0000