Arbitrary Code Execution Vulnerability in Asteval Python Library by LMFIT

CVE-2025-24359

What is CVE-2025-24359?

The Asteval library, an evaluator for Python expressions and statements, is vulnerable due to unsafe handling of input that leads to arbitrary code execution. In versions prior to 1.0.6, attackers can exploit the handling of FormattedValue AST nodes to bypass security restrictions. By manipulating the value in a dangerous format call, attackers can intentionally trigger an AttributeError exception to gain unauthorized access to sensitive object properties, potentially compromising the application's integrity.

References