CVE-2025-62162: Cel Cel-rust May Panic During Parsing Vulnerability

Q: What is CVE-2025-62162?

CVE-2025-62162 is a security vulnerability in Cel involving cel-rust May Panic During Parsing of Invalid CEL Expressions under CWE-20: Improper Input Validation.

Q: Which Cel versions are affected?

Affected versions include releases prior to 0.11.4 across affected packages: cel.

Q: What version fixes CVE-2025-62162?

Upgrading to 0.11.4 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is cel affected?

Yes, cel is affected in releases prior to 0.11.4. Upgrade your dependency to 0.11.4 or later.

Q: What is the CVSS score of CVE-2025-62162?

CVE-2025-62162 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Q: What CWE is associated with CVE-2025-62162?

CVE-2025-62162 is classified under CWE-20: Improper Input Validation (The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.).

Q: How can I check crates.io dependencies for CVE-2025-62162?

Run the dependency tree command: 'inspect dependencies for cel'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-wxwx-9fh7-5mrw

CVSS 7.5

CWE-20

Published 2025-10-11

Advisory Summary

CVE-2025-62162 is a HIGH (CVSS 7.5) cel-rust may panic during parsing vulnerability (CWE-20: Improper Input Validation) affecting Cel libraries in the crates.io ecosystem. The issue involves cel-rust may panic during parsing of invalid cel expressions. Remediation is available by upgrading affected packages to version 0.11.4.

CVE-2025-62162 at a Glance

CVE Identifier CVE-2025-62162

GHSA Identifier GHSA-wxwx-9fh7-5mrw

Severity HIGH

CVSS v3.1 Base Score 7.5

CWE Classification CWE-20: Improper Input Validation

Affected Product Cel

Package Ecosystem crates.io

Published Date 2025-10-11

Last Updated 2025-10-11

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity None (I:N)

Availability High (A:H)

How to Fix CVE-2025-62162

To remediate this vulnerability, upgrade all affected Cel dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

cel fixed: 0.11.4

Upgrade cel to 0.11.4

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for cel

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-62162, inspect your project dependencies for Cel:

inspect dependencies for cel

Analyze the terminal output to locate any version of Cel in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.11.4), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-20: Improper Input Validation, where the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. In Cel, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary Parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS). ### Remediation Upgrade to 0.11.4 ```toml [dependencies] cel = "0.11.4" ``` ### PoC ```rust use cel::{Context, Program}; fn main() { let program = Program::compile("x(1,").unwrap(); let context = Context::default(); let value = program.execute(&context).unwrap(); assert_eq!(value, true.into()); } ``` ``` $ RUST_BACKTRACE=1 cargo run --bin example-simple Compiling num-traits v0.2.19 Compiling aho-corasick v1.1.3 Compiling regex-syntax v0.8.5 Compiling arbitrary v1.4.1 Compiling serde v1.0.219 Compiling thiserror v1.0.69 Compiling regex-automata v0.4.9 Compiling chrono v0.4.41 Compiling regex v1.11.1 Compiling cel v0.10.0 (/home/john/git/cel-rust/cel) warning: `cel` (lib) generated 15 warnings Compiling example v0.1.0 (/home/john/git/cel-rust/example) Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.97s Running `target/debug/example-simple` thread 'main' panicked at /home/john/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/antlr4rust-0.3.0-beta3/src/tree.rs:383:9: internal error: entered unreachable code: should have been properly implemented by generated context when reachable stack backtrace: 0: __rustc::rust_begin_unwind 1: core::panicking::panic_fmt 2: antlr4rust::tree::Visitable::accept 3: <cel::parser::gen::celparser::UnaryContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept 4: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn 5: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node 6: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit 7: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_calc 8: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_calc 9: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::CalcContextExt>>::accept 10: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn 11: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node 12: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit 13: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_relation 14: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_relation 15: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::RelationContextExt>>::accept 16: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn 17: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node 18: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit 19: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalAnd 20: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalAnd 21: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalAndContextExt>>::accept 22: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn 23: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node 24: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit 25: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalOr 26: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalOr 27: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalOrContextExt>>::accept 28: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn 29: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node 30: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit 31: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_expr 32: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_expr 33: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ExprContextExt>>::accept 34: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn 35: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node 36: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit 37: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_GlobalCall::{{closure}} 38: <core::iter::adapters::map::Map<I,F> as core::iter::traits::iterator::Iterator>::next 39: alloc::vec::Vec<T,A>::extend_desugared 40: <alloc::vec::Vec<T,A> as alloc::vec::spec_extend::SpecExtend<T,I>>::spec_extend 41: <alloc::vec::Vec<T> as alloc::vec::spec_from_iter_nested::SpecFromIterNested<T,I>>::from_iter 42: <alloc::vec::Vec<T> as alloc::vec::spec_from_iter::SpecFromIter<T,I>>::from_iter 43: <alloc::vec::Vec<T> as core::iter::traits::collect::FromIterator<T>>::from_iter 44: core::iter::traits::iterator::Iterator::collect 45: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_GlobalCall 46: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_GlobalCall 47: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::GlobalCallContextExt>>::accept 48: <cel::parser::gen::celparser::PrimaryContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept 49: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn 50: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node 51: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit 52: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_PrimaryExpr 53: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_PrimaryExpr 54: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::PrimaryExprContextExt>>::accept 55: <cel::parser::gen::celparser::MemberContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept 56: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn 57: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node 58: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit 59: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_MemberExpr 60: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_MemberExpr 61: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::MemberExprContextExt>>::accept 62: <cel::parser::gen::celparser::UnaryContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept 63: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn 64: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node 65: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit 66: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_calc 67: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_calc 68: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::CalcContextExt>>::accept 69: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn 70: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node 71: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit 72: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_relation 73: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_relation 74: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::RelationContextExt>>::accept 75: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn 76: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node 77: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit 78: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalAnd 79: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalAnd 80: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalAndContextExt>>::accept 81: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn 82: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node 83: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit 84: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalOr 85: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalOr 86: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalOrContextExt>>::accept 87: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn 88: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node 89: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit 90: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_expr 91: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_expr note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace. ``` ### Impact Users accepting untrusted CEL expressions

CVE-2025-62162 Affected Cel Versions

1 component(s)

Fixed Versions:

0.11.4

Product / Package	Ecosystem	Affected Versions	Fixed Version
cel	crates.io	≥ 0.10.0 < 0.11.4	0.11.4

References

GitHub Advisory / Wiki ADVISORY

https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw

NVD — CVE-2025-62162 NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-62162

Security Fix Commit FIX COMMIT

https://github.com/cel-rust/cel-rust/commit/9df9822d81d91a3ce0fc9f712f4574a659247be3

Cel Source Repository REPOSITORY

https://github.com/cel-rust/cel-rust

Cel Release RELEASE

https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4

Frequently Asked Questions

What is CVE-2025-62162?

CVE-2025-62162 is a security vulnerability in Cel involving cel-rust May Panic During Parsing of Invalid CEL Expressions under CWE-20: Improper Input Validation.

Which Cel versions are affected?

Affected versions include releases prior to 0.11.4 across affected packages: cel.

What version fixes CVE-2025-62162?

Upgrading to 0.11.4 (or the latest patched release for your respective branch) resolves the vulnerability.

Is cel affected?

Yes, cel is affected in releases prior to 0.11.4. Upgrade your dependency to 0.11.4 or later.

What is the CVSS score of CVE-2025-62162?

CVE-2025-62162 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

What CWE is associated with CVE-2025-62162?

CVE-2025-62162 is classified under CWE-20: Improper Input Validation (The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.).

How can I check crates.io dependencies for CVE-2025-62162?

Run the dependency tree command: 'inspect dependencies for cel'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wxwx-9fh7-5mrw",
  "modified" : "2025-10-11T01:30:54Z",
  "published" : "2025-10-11T01:30:53Z",
  "aliases" : [ "CVE-2025-62162" ],
  "summary" : "cel-rust May Panic During Parsing of Invalid CEL Expressions",
  "details" : "### Summary\n\nParsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS).\n\n### Remediation\nUpgrade to 0.11.4\n```toml\n[dependencies]\ncel = \"0.11.4\"\n```\n\n### PoC\n\n```rust\nuse cel::{Context, Program};\n\nfn main() {\n    let program = Program::compile(\"x(1,\").unwrap();\n    let context = Context::default();\n    let value = program.execute(&context).unwrap();\n    assert_eq!(value, true.into());\n}\n```\n\n```\n$ RUST_BACKTRACE=1 cargo run --bin example-simple\n   Compiling num-traits v0.2.19\n   Compiling aho-corasick v1.1.3\n   Compiling regex-syntax v0.8.5\n   Compiling arbitrary v1.4.1\n   Compiling serde v1.0.219\n   Compiling thiserror v1.0.69\n   Compiling regex-automata v0.4.9\n   Compiling chrono v0.4.41\n   Compiling regex v1.11.1\n   Compiling cel v0.10.0 (/home/john/git/cel-rust/cel)\n\nwarning: `cel` (lib) generated 15 warnings\n   Compiling example v0.1.0 (/home/john/git/cel-rust/example)\n    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.97s\n     Running `target/debug/example-simple`\n\nthread 'main' panicked at /home/john/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/antlr4rust-0.3.0-beta3/src/tree.rs:383:9:\ninternal error: entered unreachable code: should have been properly implemented by generated context when reachable\nstack backtrace:\n   0: __rustc::rust_begin_unwind\n   1: core::panicking::panic_fmt\n   2: antlr4rust::tree::Visitable::accept\n   3: <cel::parser::gen::celparser::UnaryContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept\n   4: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n   5: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n   6: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n   7: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_calc\n   8: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_calc\n   9: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::CalcContextExt>>::accept\n  10: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  11: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  12: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  13: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_relation\n  14: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_relation\n  15: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::RelationContextExt>>::accept\n  16: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  17: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  18: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  19: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalAnd\n  20: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalAnd\n  21: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalAndContextExt>>::accept\n  22: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  23: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  24: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  25: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalOr\n  26: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalOr\n  27: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalOrContextExt>>::accept\n  28: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  29: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  30: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  31: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_expr\n  32: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_expr\n  33: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ExprContextExt>>::accept\n  34: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  35: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  36: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  37: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_GlobalCall::{{closure}}\n  38: <core::iter::adapters::map::Map<I,F> as core::iter::traits::iterator::Iterator>::next\n  39: alloc::vec::Vec<T,A>::extend_desugared\n  40: <alloc::vec::Vec<T,A> as alloc::vec::spec_extend::SpecExtend<T,I>>::spec_extend\n  41: <alloc::vec::Vec<T> as alloc::vec::spec_from_iter_nested::SpecFromIterNested<T,I>>::from_iter\n  42: <alloc::vec::Vec<T> as alloc::vec::spec_from_iter::SpecFromIter<T,I>>::from_iter\n  43: <alloc::vec::Vec<T> as core::iter::traits::collect::FromIterator<T>>::from_iter\n  44: core::iter::traits::iterator::Iterator::collect\n  45: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_GlobalCall\n  46: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_GlobalCall\n  47: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::GlobalCallContextExt>>::accept\n  48: <cel::parser::gen::celparser::PrimaryContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept\n  49: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  50: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  51: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  52: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_PrimaryExpr\n  53: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_PrimaryExpr\n  54: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::PrimaryExprContextExt>>::accept\n  55: <cel::parser::gen::celparser::MemberContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept\n  56: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  57: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  58: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  59: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_MemberExpr\n  60: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_MemberExpr\n  61: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::MemberExprContextExt>>::accept\n  62: <cel::parser::gen::celparser::UnaryContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept\n  63: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  64: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  65: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  66: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_calc\n  67: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_calc\n  68: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::CalcContextExt>>::accept\n  69: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  70: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  71: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  72: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_relation\n  73: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_relation\n  74: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::RelationContextExt>>::accept\n  75: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  76: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  77: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  78: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalAnd\n  79: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalAnd\n  80: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalAndContextExt>>::accept\n  81: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  82: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  83: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  84: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalOr\n  85: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalOr\n  86: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalOrContextExt>>::accept\n  87: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  88: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  89: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  90: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_expr\n  91: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_expr\nnote: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.\n```\n\n### Impact\nUsers accepting untrusted CEL expressions",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "cel"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.10.0"
      }, {
        "fixed" : "0.11.4"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-62162"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cel-rust/cel-rust/commit/9df9822d81d91a3ce0fc9f712f4574a659247be3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/cel-rust/cel-rust"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-10-11T01:30:53Z",
    "nvd_published_at" : "2025-10-10T23:15:36Z"
  }
}

CVSS V3

7.5 HIGH