Junglewise Threat Intelligence

CVE-2025-24359: PYSEC-2026-1195 - ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape

CVE-2025-24359 · Severity: low · CVSS 3.1 · Published 2026-07-07

Technologies: asteval (PyPI). Vendors: PyPI.

Executive brief

ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape

Affected products

PyPI asteval

Related threats

ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemEx
asteval sandbox escape via numpy ctypes arbitrary memory read/write