CVE-2025-3753 - CVE House

Back to Database

Status published High CVE-2025-3753

Unsafe use of eval() method in rosbag tool

7.8 CVSS

Vulnerability Description

A code execution vulnerability has been identified in the Robot Operating System (ROS) 'rosbag' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() function to process unsanitized, user-supplied input in the 'rosbag filter' command. This flaw enables attackers to craft and execute arbitrary Python code.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3753

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Giuseppe Barbieri, Ubuntu Robotics Team

References

https://www.ros.org/blog/noetic-eol/

More from Open Source Robotics Foundation

View All →

Unsafe use of eval() method in rostopic echo tool

Unsafe use of eval() method in rostopic hz tool

Unsafe use of eval() method in roslaunch tool

Use of unsafe yaml load in dynparam

Unsafe use of eval() method in rosparam tool

Affected Vendor

Open Source Robotics Foundation

View all reports →

Affected Software

Robot Operating System (ROS)

Vulnerable Versions:

Noetic Ninjemys, Melodic Morenia, Kinetic Kame, Indigo Igloo

Timeline

Official Publish: July 17th, 2025

Last Modified: July 18th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1565.002 Stored Data Manipulation