CVE-2026-102734
5.5MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on availability
- Weakness
- CWE-693, CWE-749, CWE-913
Impact
Attackers can escape the Python sandbox to read or corrupt host process memory and execute arbitrary code. They need the ability to supply an expression evaluated by an asteval Interpreter configured with numpy.
Root cause
The numpy-enabled Interpreter exposes ctypes type objects allowing from_address memory access, while safe_getattr fails to block reachable ctypes types and attribute assignments bypass safe_setattr.
Affected systems
asteval prior to 1.0.9 (when numpy is enabled)
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade asteval to version 1.0.9 or later. If upgrading immediately is not possible, disable numpy support in the asteval Interpreter configuration.
$ pip install --upgrade 'asteval>=1.0.9'AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9.