CVE-2025-3753 Details
Description
A code execution vulnerability has been identified in the Robot Operating System (ROS) 'rosbag' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() function to process unsanitized, user-supplied input in the 'rosbag filter' command. This flaw enables attackers to craft and execute arbitrary Python code.
A code execution vulnerability exists in the Robot Operating System (ROS) 'rosbag' tool, impacting ROS distributions Noetic Ninjemys and earlier. The issue stems from the 'rosbag filter' command, which uses the eval() function to process unsanitized user input. This vulnerability allows attackers to craft and execute arbitrary Python code.
Users are encouraged to migrate to ROS 2, as ROS 1 Noetic will reach end-of-life on May 31, 2025. After this date, Noetic users may be exposed to unpatched security vulnerabilities. Migration options include transitioning to ROS 2 Humble Hawksbill or ROS 2 Jazzy Jalisco, depending on the complexity of the ROS 1 project. For projects that are tightly coupled or complex, the ROS 1 to ROS 2 Bridge can be used to migrate one package at a time.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.ros.org/blog/noetic-eol/ | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openrobotics robot operating system | indigo_igloo kinetic_kame melodic_morenia noetic_ninjemys |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 26, 2025 | Initial Analysis | [email protected] |
| Jul 17, 2025 | New CVE Received | [email protected] |