PT-2025-24425 · Redash · Redash

Gavin Zhong + 2 · Published 2025-06-09 · Updated 2025-06-09 · CVE-2025-5874

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Redash versions up to 10.1.0/25.1.0

Description A critical issue affects the run query function of the /query runner/python.py file in the getattr Handler component, leading to a sandbox issue. The exploit has been disclosed publicly and may be used. The vendor was contacted about this disclosure but did not respond.

Recommendations For Redash versions up to 10.1.0/25.1.0, as a temporary workaround, consider disabling the run query function until a patch is available. Restrict access to the /query runner/python.py file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-265

CWE-264

Related Identifiers

CVE-2025-5874

Affected Products

Redash

References · 10

• 🔥 https://gist.github.com/superboy-zjc/1f89d375e2408ed843dc2cf0bb1bb894#proof-of-concept · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5874 · Security Note
• https://twitter.com/VulmonFeeds/status/1932067519205941391 · Twitter Post
• https://vuldb.com/?id.311633 · Note
• https://t.me/cvetracker/25771 · Telegram Post
• https://vuldb.com/?submit.580255 · Note
• https://gist.github.com/superboy-zjc/1f89d375e2408ed843dc2cf0bb1bb894 · Note
• https://vuldb.com/?ctiid.311633 · Note
• https://t.me/cvenotify/125063 · Telegram Post
• https://twitter.com/CVEnew/status/1932037607300411875 · Twitter Post