CVE-2026-102734

Published: Ott 13, 2026 Last Modified: Ott 13, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,5
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9.

693

Protection Mechanism Failure

Draft
Abstraction: Pillar Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
Technologies: Not Technology-Specific, ICS/OT
View CWE Details
749

Exposed Dangerous Method or Function

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability Access Control Other
Potential Impacts:
Gain Privileges Or Assume Identity Read Application Data Modify Application Data Execute Unauthorized Code Or Commands Other
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: Low
View CWE Details
913

Improper Control of Dynamically-Managed Code Resources

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Other
Potential Impacts:
Execute Unauthorized Code Or Commands Varies By Context Alter Execution Logic
Applicable Platforms
Languages: Not Language-Specific, Interpreted
View CWE Details
https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817…
https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4
https://github.com/lmfit/asteval/pull/153
https://github.com/lmfit/asteval/pull/153
https://github.com/lmfit/asteval/releases/tag/1.0.9
https://github.com/lmfit/asteval/releases/tag/1.0.9
https://github.com/lmfit/asteval/security/advisories/GHSA-9…
https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx