PT-2025-29958 · Ros+1 · Rosbag+1

Published 2025-07-17 · Updated 2025-07-18 · CVE-2025-3753

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ROS versions prior to Noetic Ninjemys

Description A code execution issue has been identified in the 'rosbag' tool. The vulnerability stems from the use of the eval() function to process unsanitized, user-supplied input within the 'rosbag filter' command. This allows attackers to execute arbitrary Python code.

Recommendations For versions prior to Noetic Ninjemys, avoid using the 'rosbag filter' command with untrusted input.

Fix

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

CVE-2025-3753

Affected Products

Debian

Rosbag

References · 10

• https://security-tracker.debian.org/tracker/CVE-2025-3753 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-3753 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-3753 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-3753 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-3753 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-3753 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-3753 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1946009234425921762 · Twitter Post
• https://ros.org/blog/noetic-eol · Note
• https://twitter.com/CVEnew/status/1945932468185600344 · Twitter Post