CVE-2025-3753: Unsafe use of eval() method in rosbag tool

Q: What is the severity of CVE-2025-3753?

CVE-2025-3753 has a high severity rating due to its potential for arbitrary code execution.

Q: How do I fix CVE-2025-3753?

To mitigate CVE-2025-3753, update to a patched version of ROS that no longer utilizes the vulnerable eval() function.

Q: Which versions of Robot Operating System are affected by CVE-2025-3753?

CVE-2025-3753 affects all ROS distributions up to and including Noetic Ninjemys.

Q: What is the impact of CVE-2025-3753 on devices using ROS?

CVE-2025-3753 can allow an attacker to execute arbitrary code on devices running affected versions of ROS.

Q: Is there a workaround available for CVE-2025-3753?

There are no known workarounds for CVE-2025-3753, thus updating to a fixed version is the recommended approach.

Published Jul 17, 2025

Updated

A code execution vulnerability has been identified in the Robot Operating System (ROS) 'rosbag' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() function to process unsanitized, user-supplied input in the 'rosbag filter' command. This flaw enables attackers to craft and execute arbitrary Python code.

Affected Software

5 affected components

Open Robotics Robot Operating System<Noetic

Openrobotics Robot Operating System=indigo_igloo

Openrobotics Robot Operating System=kinetic_kame

Openrobotics Robot Operating System=melodic_morenia

Openrobotics Robot Operating System=noetic_ninjemys

Remediation

Information

All ROS (1) versions are EOL, upgrade to a ROS 2 version.

Event History

Jul 17, 2025

CVE Published

via MITRE·07:14 PM

Data Sourced

via MITRE·07:14 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-3753?

CVE-2025-3753 has a high severity rating due to its potential for arbitrary code execution.

How do I fix CVE-2025-3753?