# CVE-2025-24359: PYSEC-2026-1195 - ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape

Source: https://junglewise.ai/threats/cve-2025-24359-asteval-allows-maliciously-crafted-format-strings-to-lead-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2025-24359 · Severity: low · CVSS 3.1 · Published 2026-07-07

ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape

Technologies: [asteval (PyPI)](https://junglewise.ai/threats/technologies/asteval). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-24359 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-24359 being exploited in the wild.

**How severe is CVE-2025-24359?** Low severity, with a CVSS score of 3.1, published 7 July 2026.

**Which products and versions are affected?** asteval (PyPI) ECOSYSTEM:introduced=0,fixed=1.0.6.

**Is there a fix for CVE-2025-24359?** Yes. asteval (PyPI): upgrade to 1.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-24359?** Check whether you run asteval (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- asteval (PyPI): upgrade to 1.0.6 or later

  ```sh
  pip install "asteval>=1.0.6"
  ```


## Affected products

- asteval (PyPI) ECOSYSTEM:introduced=0,fixed=1.0.6

## Identifiers

- CVE-2025-24359
- GHSA-3wwr-3g9f-9gc7
- PYSEC-2026-1195

## Related threats

- [asteval Interpreter sandbox escape via BaseException subclasses](https://junglewise.ai/threats/cve-2026-55244-asteval-interpreter-sandbox-escape-via-baseexception-subclasses)
- [asteval sandbox escape via numpy ctypes arbitrary memory read/write](https://junglewise.ai/threats/asteval-sandbox-escape-via-numpy-ctypes-arbitrary-memory-read-write-a89cc527)
- [ASTEVAL Allows Malicious Tampering of Exposed AST Nodes Leads to Sandbox Escape](https://junglewise.ai/threats/asteval-allows-malicious-tampering-of-exposed-ast-nodes-leads-to-7ada8428)