CVE-2026-32640

danthedeckie simpleeval

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-32640

Katalog CVE

CVSS 9.8 · Critical EPSS 0,87%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada danthedeckie simpleeval. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

Rincian

Terbit di NVD
16 Maret 2026
Terakhir diubah
15 Juli 2026
Status NVD
Modified
CVSS 3.1
9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
EPSS (30 hari)
0,87% peluang dieksploitasi; lebih tinggi dari 57,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
danthedeckie simpleeval Semua versi sebelum 1.0.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.