Source: python-asteval X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerability was published for python-asteval. CVE-2026-102734[0]: | asteval is a Python expression evaluator designed for restricted | execution. Prior to 1.0.9, in asteval/astutils.py, the default | Interpreter with numpy enabled exposes a ctypes type and permits | from_address memory access. safe_getattr blocks the ctypes module | but not reachable ctypes type objects, while attribute assignments | use unfiltered setattr instead of safe_setattr. An attacker- | controlled expression can derive an address with id, read memory | through from_address, and write through an attribute assignment. The | expression can read or corrupt arbitrary process memory, escape the | intended sandbox, execute code, disclose secrets, or crash the host | process. This issue is fixed in version 1.0.9. https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx https://github.com/lmfit/asteval/pull/153 Fixed by (merge): https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4 (1.0.9) If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-102734 https://www.cve.org/CVERecord?id=CVE-2026-102734 Please adjust the affected versions in the BTS as needed.
