{"action":"Upgrade asteval to 1.0.6 or later.","affected":[{"fixed":"1.0.6","introduced":"0"}],"component":"asteval","cve_ids":["CVE-2025-24359"],"ecosystem":"PyPI","epss":0.00278,"exploited":false,"fixed_versions":["1.0.6"],"ghsa_id":"GHSA-3wwr-3g9f-9gc7","id":"tcs_01M5KGR4HQF2ZVXED039GBTRF7","modified_at":"2026-07-07T17:47:11.830131816Z","published_at":"2026-07-07T14:34:49.119921Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1195","https://github.com/lmfit/asteval/security/advisories/GHSA-3wwr-3g9f-9gc7","https://nvd.nist.gov/vuln/detail/CVE-2025-24359","https://github.com/lmfit/asteval/commit/45bb47533f7abb5479618ae7f6a809215700dcb2","https://github.com/lmfit/asteval","https://github.com/lmfit/asteval/blob/cfb57f0beebe0dc0520a1fbabc35e66060c7ea71/asteval/asteval.py#L507","https://lucumr.pocoo.org/2016/12/29/careful-with-str-format","https://pypi.org/project/asteval","https://github.com/advisories/GHSA-3wwr-3g9f-9gc7"],"severity":{"label":"high","score":8.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-1195","url":"https://osv.dev/vulnerability/PYSEC-2026-1195"}],"summary":"ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape"}