CVE-2025-3753highCWE-94CWE-95

CVE-2025-3753: high-severity vulnerability in Open Source Robotics Foundation Robot…

Unsafe use of eval() method in rosbag tool

Published · Updated

Follow this CVE+ Monitor Robot Operating System+ Monitor ros-ros-comm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.8epss 0.2%
A code execution vulnerability has been identified in the Robot Operating System (ROS) 'rosbag' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() function to process unsanitized, user-supplied input in the 'rosbag filter' command. This flaw enables attackers to craft and execute arbitrary Python code.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Open Source Robotics Foundation · Robot Operating System (ROS)
Related CVEs — Open Source Robotics Foundation Robot…

In the same product, most dangerous first.

CVE-2024-39780HIGHUse of unsafe yaml load in dynparamEPSS 0.4%CVE-2024-41921HIGHUnsafe use of eval() method in rostopic echo toolEPSS 0.2%CVE-2024-41148HIGHUnsafe use of eval() method in rostopic hz toolEPSS 0.2%CVE-2024-39289HIGHUnsafe use of eval() method in rosparam toolEPSS 0.2%CVE-2024-39835HIGHUnsafe use of eval() method in roslaunch toolEPSS 0.2%