Which versions of Python are affected by CVE-2025-5874?

Organizations using Redash should be aware of moderate risk from CVE-2025-5874 rated CVSS 4.6. Exploitation could compromise the security of affected deployments.

Is there a public PoC exploit available for CVE-2025-5874?

Yes, a public proof-of-concept exploit is available for CVE-2025-5874. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-5874?

Within 30 days: Identify affected systems running Redash and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Python CVE-2025-5874

Q: What is the CVSS score of CVE-2025-5874?

CVE-2025-5874 has a CVSS 4.0 base score of 1.2 (Low). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-17453 LOW

Permissions, Privileges, and Access Controls (CWE-264)

2025-06-09 cna@vuldb.com

Privilege Escalation Python

1.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.2 LOW

CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.6 (MEDIUM) 1.2 (LOW)

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17453

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

PoC Detected

Jul 16, 2025 - 15:15 vuln.today

Public exploit code

CVE Published

Jun 09, 2025 - 11:15 cve.org

LOW 1.2

CVE Published

Jun 09, 2025 - 11:15 nvd

MEDIUM 4.6

DescriptionCVE.org

A vulnerability was found in Redash up to 10.1.0/25.1.0. It has been rated as problematic. This issue affects the function run_query of the file /query_runner/python.py of the component getattr Handler. The manipulation leads to sandbox issue. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains, that "[t]he Python data source is disabled by default and is clearly marked in our documentation as discouraged due to its security implications. Users who choose to enable it are doing so at their own risk, with full awareness that it bypasses standard safeguards."

AnalysisAI

Privilege escalation via a sandbox escape in Redash Python data source allows authenticated adjacent-network attackers with low privileges to execute arbitrary code, bypassing standard safeguards. This vulnerability affects Redash versions through 10.1.0/25.1.0 only when the optional, disabled-by-default Python data source is manually enabled. A publicly available proof-of-concept demonstrates the technique, but the vendor disputes it as a bug, noting the feature is explicitly discouraged due to inherent security risks.