PT-2026-25385 · Unknown · Simpleeval

Byamb4 · Published 2026-01-01 · Updated 2026-05-25 · CVE-2026-32640

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SimpleEval versions prior to 1.0.5

Description SimpleEval is a Python library used for adding evaluatable expressions to projects. Before version 1.0.5, the library allowed dangerous modules to be accessed directly within the sandbox. This occurred when objects passed as names to SimpleEval had modules or other disallowed objects available as attributes. Additionally, dangerous functions or modules could be accessed by providing them as callbacks to otherwise safe functions. Examples of modules with potentially dangerous attributes include os.path, pathlib, shutil, glob, statistics, numpy, and urllib.parse. The vulnerability allows access to potentially dangerous items through direct attributes.

Recommendations Versions prior to 1.0.5 should be updated to version 1.0.5 or later. Avoid passing objects or modules with direct attributes to potentially dangerous items. Use a wrapper to encapsulate potentially vulnerable items.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-915

CWE-94

Related Identifiers

CVE-2026-32640

GHSA-44VG-5WV2-H2HG

OPENSUSE-SU-2026:10373-1

OPENSUSE-SU-2026:20393-1

PYSEC-2026-132

USN-8301-1

Affected Products

Simpleeval

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32640.json · Exploit
• https://github.com/danthedeckie/simpleeval/security/advisories/GHSA-44vg-5wv2-h2hg · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10373-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32640 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32640 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20393-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32640 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32640 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-132 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32640 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32640 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32640 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8301-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-44vg-5wv2-h2hg · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8301-1 · Vendor Advisory