High severity · published Jul 17, 2025
CVE-2025-3753
Unsafe use of eval() method in rosbag tool
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A code execution vulnerability has been identified in the Robot Operating System (ROS) 'rosbag' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() function to process unsanitized, user-supplied input in the 'rosbag filter' command. This flaw enables attackers to craft and execute arbitrary Python code.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RO
Robot Operating System (ROS) · Open Source Robotics Foundation
Noetic Ninjemys; Melodic Morenia; Kinetic Kame; Indigo Igloo · source: vendor
RO
Robot Operating System · Openrobotics
indigo_igloo; kinetic_kame; melodic_morenia; noetic_ninjemys · source: NVD
Affected product
RO
Robot Operating System (ROS)
Open Source Robotics Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3753
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3753
Product
https://www.ros.org/blog/noetic-eol/
More from Robot Operating System (ROS)
9.8
CVE-2024-39780
Use of unsafe yaml load in dynparam
7.8
CVE-2024-41921
Unsafe use of eval() method in rostopic echo tool
7.8
CVE-2024-41148
Unsafe use of eval() method in rostopic hz tool
7.8
CVE-2024-39835
Unsafe use of eval() method in roslaunch tool
7.8
CVE-2024-39289
Unsafe use of eval() method in rosparam tool