lmfit asteval up to 1.0.5 str format string

Summaryinfo

A vulnerability, which was classified as critical, was found in lmfit asteval up to 1.0.5. The affected element is the function str. Such manipulation leads to format string. This vulnerability is listed as CVE-2025-24359. The attack must be carried out locally. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in lmfit asteval up to 1.0.5 and classified as critical. Affected by this issue is the function str. The manipulation with an unknown input leads to a format string vulnerability. Using CWE to declare the problem leads to CWE-134. The product uses a function that accepts a format string as an argument, but the format string originates from an external source. Impacted is confidentiality, integrity, and availability. CVE summarizes:

ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is rooted in how `asteval` performs handling of `FormattedValue` AST nodes. In particular, the `on_formattedvalue` value uses the dangerous format method of the str class. The code allows an attacker to manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)`. This vulnerability can be exploited to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. Version 1.0.6 fixes this issue.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-24359 since 01/20/2025. The exploitation is known to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 241666 (Fedora 43 : python-asteval (2025-99d252d8fc)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.0.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (241666). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• lmfit

Name

• asteval

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5

Website

• Product: https://github.com/lmfit/asteval/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion