Unsafe use of eval() method in rosbag tool

The vulnerability's impact is severe due to the ability to execute arbitrary Python code. An attacker could leverage this to gain complete control over a ROS-enabled system, potentially leading to data theft, system compromise, or denial of service. The rosbag filter command is frequently used for analyzing and processing ROS bag files, making it a common target. This vulnerability is particularly concerning in environments where ROS is used for critical automation or robotics applications, as it could be exploited to disrupt operations or compromise sensitive data. The use of eval() on untrusted input mirrors vulnerabilities seen in other scripting languages, highlighting the inherent risks of dynamic code execution.

Robotics researchers and developers using ROS Noetic Ninjemys or earlier versions are at significant risk. Organizations deploying ROS in industrial automation or critical infrastructure environments are particularly vulnerable, as a successful exploit could have severe operational consequences. Users who have shared ROS bag files from untrusted sources are also at increased risk.

• python / rosbag:

import subprocess
# Check for suspicious arguments passed to rosbag filter
process = subprocess.Popen(['rosbag', 'filter', '-u', 'your_bag_file'], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
output, error = process.communicate()
if 'eval' in output or 'eval' in error:
    print('Potential CVE-2025-3753 exploitation attempt detected!')

• linux / server:

journalctl -u ros | grep -i "eval"

• generic web: Inspect ROS bag files for embedded Python code or commands that could be executed via rosbag filter.

1. 2025-07-17Disclosure

   disclosure

1. Réservé2025-04-16
2. Publiée2025-07-17
3. Modifiée2025-07-18
4. EPSS mis à jour2026-03-23

The primary mitigation is to upgrade to a patched version of ROS once available. Until a patch is released, implement strict input validation on the rosbag filter command to prevent the execution of malicious code. Specifically, sanitize any user-supplied input before passing it to the eval() function. Consider restricting access to the rosbag filter command to trusted users only. Additionally, review ROS bag files from untrusted sources with extreme caution. After applying mitigations, verify the integrity of your ROS installation and ensure that the rosbag filter command no longer accepts unsanitized input.