CVE-2025-5874

low

Description

A vulnerability was found in Redash up to 10.1.0/25.1.0. It has been rated as critical. This issue affects the function run_query of the file /query_runner/python.py of the component getattr Handler. The manipulation leads to sandbox issue. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

https://vuldb.com/?submit.580255

https://vuldb.com/?id.311633

https://vuldb.com/?ctiid.311633

https://gist.github.com/superboy-zjc/1f89d375e2408ed843dc2cf0bb1bb894#proof-of-concept

https://gist.github.com/superboy-zjc/1f89d375e2408ed843dc2cf0bb1bb894

Details

Source: Mitre, NVD

Published: 2025-06-09

Updated: 2025-06-09

Risk Information

CVSS v2

Base Score: 5.2

Vector: CVSS2#AV:A/AC:L/Au:S/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 5.5

Vector: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Severity: Medium

CVSS v4

Base Score: 2

Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Severity: Low

EPSS

EPSS: 0.00019