Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An attacker who can supply expressions to asteval.Interpreter.eval() can raise SystemExit, KeyboardInterrupt, GeneratorExit, or BaseException from inside the sandbox. These exceptions are subclasses of BaseException but not Exception, so they bypass the except Exception: safety net in both run() and eval(). The exception propagates verbatim to the calling application, terminating the process or disrupting signal and cleanup handlers. This is distinct from prior vulnerabilities CVE-2025-24359 (format string injection) and GHSA-vp47-9734-prjw (AST mutation TOCTOU), both fixed in 1.0.6. This vector is present in all versions including 1.0.6 and current HEAD. --- Affected Code asteval/astutils.py, lines 89–108 — FROMPY exposes dangerous classes to sandbox users: asteval/asteval.py, line 322 — run() exception handler: asteval/asteval.py, line 370 — eval() exception handler: asteval/asteval.py, line 264 — raiseexception() raises the class directly: --- Root Cause Python's exception…
Recommended action: Upgrade to 1.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
With its default configuration (numpy enabled, import disabled), asteval's Interpreter lets an attacker-controlled expression obtain a raw arbitrary process-memory read and write primitive, without using import, any dunder attribute, or eval/exec/getattr. Arbitrary in-process read/write is equivalent to arbitrary code execution and is a complete escape of the sandbox whose entire purpose is "untrusted string in, no arbitrary execution out." Any application that feeds untrusted input to asteval with numpy installed (the default) is affected. Details asteval's attribute filter (asteval/astutils.py: safegetattr) blocks every dunder name and blocks objects whose attribute value is identity-equal to one of the modules in UNSAFEMODULES = {io, os, sys, ctypes}. The ctypes module entry was added recently (commit 9d9d430) and correctly blocks ndarray.ctypes.ctypes. However, the module check is identity-only against the ctypes module. It does not cover ctypes type objects and their…
Recommended action: Upgrade to 1.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
If an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. Details The vulnerability is rooted in how asteval performs handling of FormattedValue AST nodes. In particular, the onformattedvalue value uses the dangerous format method of the str class, as shown in the vulnerable code snippet below: The code above allows an attacker to manipulate the value of the string used in the dangerous call fmt.format(fstring=val). This vulnerability can be exploited to access protected attributes by intentionally triggering an AttributeError exception. The attacker can then catch the exception and use its obj attribute to gain arbitrary access to sensitive or protected object properties. PoC The following proof-of-concept (PoC) demonstrates how this vulnerability can be exploited to execute the whoami command on the host machine:
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
If an attacker can control the input to the asteval library, they can bypass its safety restrictions and execute arbitrary Python code within the application's context. Details The vulnerability is rooted in how asteval performs attribute access verification. In particular, the onattribute node handler prevents access to attributes that are either present in the UNSAFEATTRS list or are formed by names starting and ending with , as shown in the code snippet below: While this check is intended to block access to sensitive Python dunder methods (such as getattribute), the flaw arises because instances of the Procedure class expose their AST (stored in the body attribute) without proper protection: Since the body attribute is not protected by a naming convention that would restrict its modification, an attacker can modify the AST of a Procedure during runtime to leverage unintended behaviour. The exploit works as follows: 1. The Time of Check, Time of Use (TOCTOU) Gadget: In the…
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.