Use of Externally-Controlled Format String Affecting python-asteval package, versions <1.0.6-2
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ECHOLATEST-PYTHONASTEVAL-19883809
- published17 Sept 2026
- disclosed24 Jan 2025
Introduced: 24 Jan 2025
CVE-2025-24359 (opens in a new tab)How to fix?
Upgrade Echo:latest python-asteval to version 1.0.6-2 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream python-asteval package and not the python-asteval package as distributed by Echo.
See How to fix? for Echo:latest relevant fixed versions and status.
ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is rooted in how asteval performs handling of FormattedValue AST nodes. In particular, the on_formattedvalue value uses the dangerous format method of the str class. The code allows an attacker to manipulate the value of the string used in the dangerous call fmt.format(__fstring__=val). This vulnerability can be exploited to access protected attributes by intentionally triggering an AttributeError exception. The attacker can then catch the exception and use its obj attribute to gain arbitrary access to sensitive or protected object properties. Version 1.0.6 fixes this issue.