CVE-2025-3753CWE-94CWE-95

Unsafe use of eval() method in rosbag tool

High · published July 17, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
12.8
In the wild
Unconfirmed
What it is

A code execution vulnerability has been identified in the Robot Operating System (ROS) 'rosbag' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() function to process unsanitized, user-supplied input in the 'rosbag filter' command. This flaw enables attackers to craft and execute arbitrary Python code.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00228 · 12.8th percentile
Weaknesses
CWE-94 · Improper Control of Generation of Code ('Code Injection'); CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2025-07-17T19:14Z
EPSS history
Timeline
  • 17 JUL 19:14Z
    Unsafe use of eval() method in rosbag tool
    cvelistv5