{"action":"Upgrade asteval to 1.0.6 or later.","affected":[{"fixed":"1.0.6","introduced":"0"}],"component":"asteval","cve_ids":["CVE-2025-24359"],"ecosystem":"PyPI","epss":0.00278,"exploited":false,"fixed_versions":["1.0.6"],"ghsa_id":"GHSA-3wwr-3g9f-9gc7","id":"tcs_01M5KEWQ1V850QG9FWZXZ9EGZW","modified_at":"2026-07-07T17:57:00.410027122Z","published_at":"2025-01-24T18:45:30Z","references":["https://osv.dev/vulnerability/GHSA-3wwr-3g9f-9gc7","https://github.com/lmfit/asteval/security/advisories/GHSA-3wwr-3g9f-9gc7","https://nvd.nist.gov/vuln/detail/CVE-2025-24359","https://github.com/lmfit/asteval/commit/45bb47533f7abb5479618ae7f6a809215700dcb2","https://github.com/lmfit/asteval","https://github.com/lmfit/asteval/blob/cfb57f0beebe0dc0520a1fbabc35e66060c7ea71/asteval/asteval.py#L507","https://lucumr.pocoo.org/2016/12/29/careful-with-str-format"],"severity":{"label":"high","score":8.4},"sources":[{"source":"osv","source_id":"GHSA-3wwr-3g9f-9gc7","url":"https://osv.dev/vulnerability/GHSA-3wwr-3g9f-9gc7"}],"summary":"ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape"}