CVE-2025-3753 Unsafe use of eval() method in rosbag tool

What is CVE-2025-3753?

CVE-2025-3753 is a high-severity vulnerability in Open Source Robotics Foundation Robot Operating System (ROS), published on 17 Jul 2025.

Official description

A code execution vulnerability has been identified in the Robot Operating System (ROS) 'rosbag' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() function to process unsanitized, user-supplied input in the 'rosbag filter' command. This flaw enables attackers to craft and execute arbitrary Python code.

Weakness: CWE-95, CWE-94

Which versions are affected by CVE-2025-3753?

It affects 1 product.

Products include Openrobotics Robot Operating System.

How do I fix CVE-2025-3753?

No fix has been published for CVE-2025-3753 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-3753 being exploited?

There is no known exploitation of CVE-2025-3753 in the wild and no public exploit code.

Other vulnerabilities in Open Source Robotics Foundation Robot Operating System (ROS)

• CVE-2024-38921 Use after free in n/a Critical 9.8
• CVE-2024-41644 Privilege escalation in n/a Critical 9.8
• CVE-2024-41645 Privilege escalation in n/a Critical 9.8
• CVE-2024-41646 Code injection in n/a Critical 9.8
• CVE-2024-41647 Code injection in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-3753, GHSA-rrcg-cxhw-9798, UBUNTU-CVE-2025-3753.