Vulnerability-Lookup

CVE-2026-102734 (GCVE-0-2026-102734)

Vulnerability from cvelistv5 – Published: 2026-10-13 15:29 – Updated: 2026-10-13 20:22

Title

asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

Summary

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 20:13 UTC

CWE

CWE-693 - Protection Mechanism Failure
CWE-749 - Exposed Dangerous Method or Function
CWE-913 - Improper Control of Dynamically-Managed Code Resources

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7606 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/lmfit/asteval/security/advisor…	x_refsource_CONFIRM
https://github.com/lmfit/asteval/pull/153	x_refsource_MISC
https://github.com/lmfit/asteval/commit/a3e56e7f8…	x_refsource_MISC
https://github.com/lmfit/asteval/releases/tag/1.0.9	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
lmfit	asteval	Affected: < 1.0.9	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102734",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T20:13:07.578455Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T20:22:29.684Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "asteval",
          "vendor": "lmfit",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749: Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-913",
              "description": "CWE-913: Improper Control of Dynamically-Managed Code Resources",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T15:29:49.209Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx"
        },
        {
          "name": "https://github.com/lmfit/asteval/pull/153",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lmfit/asteval/pull/153"
        },
        {
          "name": "https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4"
        },
        {
          "name": "https://github.com/lmfit/asteval/releases/tag/1.0.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lmfit/asteval/releases/tag/1.0.9"
        }
      ],
      "source": {
        "advisory": "GHSA-9w56-46f6-3qhx",
        "discovery": "UNKNOWN"
      },
      "title": "asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102734",
    "datePublished": "2026-10-13T15:29:49.209Z",
    "dateReserved": "2026-09-29T16:19:11.295Z",
    "dateUpdated": "2026-10-13T20:22:29.684Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "asteval",
                "vendor": "lmfit",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.0.9"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9."
          }
        ],
        "id": "CVE-2026-102734",
        "lastModified": "2026-10-13T21:17:20.823",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-102734",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T20:13:07.578455Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-13T16:17:09.820",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/lmfit/asteval/pull/153"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/lmfit/asteval/releases/tag/1.0.9"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-693"
              },
              {
                "lang": "en",
                "value": "CWE-749"
              },
              {
                "lang": "en",
                "value": "CWE-913"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-102734",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-13T20:13:07.578455Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-13T20:13:08.966Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "asteval",
              "vendor": "lmfit",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.0.9"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-693",
                  "description": "CWE-693: Protection Mechanism Failure",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-749",
                  "description": "CWE-749: Exposed Dangerous Method or Function",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-913",
                  "description": "CWE-913: Improper Control of Dynamically-Managed Code Resources",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-13T15:29:49.209Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx"
            },
            {
              "name": "https://github.com/lmfit/asteval/pull/153",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/lmfit/asteval/pull/153"
            },
            {
              "name": "https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4"
            },
            {
              "name": "https://github.com/lmfit/asteval/releases/tag/1.0.9",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/lmfit/asteval/releases/tag/1.0.9"
            }
          ],
          "source": {
            "advisory": "GHSA-9w56-46f6-3qhx",
            "discovery": "UNKNOWN"
          },
          "title": "asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-102734",
        "datePublished": "2026-10-13T15:29:49.209Z",
        "dateReserved": "2026-09-29T16:19:11.295Z",
        "dateUpdated": "2026-10-13T20:22:29.684Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-102734

Vulnerability from fkie_nvd - Published: 2026-10-13 16:17 - Updated: 2026-10-13 21:17

Severity

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4
	security-advisories@github.com	https://github.com/lmfit/asteval/pull/153
	security-advisories@github.com	https://github.com/lmfit/asteval/releases/tag/1.0.9
	security-advisories@github.com	https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "asteval",
          "vendor": "lmfit",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.9"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9."
    }
  ],
  "id": "CVE-2026-102734",
  "lastModified": "2026-10-13T21:17:20.823",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-102734",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-13T20:13:07.578455Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-13T16:17:09.820",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lmfit/asteval/pull/153"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lmfit/asteval/releases/tag/1.0.9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-693"
        },
        {
          "lang": "en",
          "value": "CWE-749"
        },
        {
          "lang": "en",
          "value": "CWE-913"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-9W56-46F6-3QHX

Vulnerability from github – Published: 2026-08-20 17:26 – Updated: 2026-08-20 17:26

Summary

asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

Details

Summary

With its default configuration (numpy enabled, import disabled), asteval's Interpreter lets an attacker-controlled expression obtain a raw arbitrary process-memory read and write primitive, without using import, any __dunder__ attribute, or eval/exec/getattr. Arbitrary in-process read/write is equivalent to arbitrary code execution and is a complete escape of the sandbox whose entire purpose is "untrusted string in, no arbitrary execution out." Any application that feeds untrusted input to asteval with numpy installed (the default) is affected.

Details

asteval's attribute filter (asteval/astutils.py: safe_getattr) blocks every __dunder__ name and blocks objects whose attribute value is identity-equal to one of the modules in UNSAFE_MODULES = {io, os, sys, ctypes}. The ctypes module entry was added recently (commit 9d9d430) and correctly blocks ndarray.ctypes._ctypes.

However, the module check is identity-only against the ctypes module. It does not cover ctypes type objects and their metaclass methods, which are reachable through numpy's ndarray.ctypes wrapper using only ordinary (non-dunder) attribute names:

zeros(1, dtype=int32).ctypes.shape._type_      ->  <class 'ctypes.c_long'>

ndarray.ctypes exposes .shape (a ctypes array) whose element type ._type_ is ctypes.c_long. None of ctypes, .shape, ._type_ is a dunder, none is in UNSAFE_ATTRS, and the returned value is a type, not the ctypes module, so safe_getattr permits all of them.

On that ctypes type, the metaclass method from_address is reachable (non-dunder, not in UNSAFE_ATTRS; it is not even listed by dir(), which is likely why it was missed):

Arbitrary read: c_long.from_address(addr).value reads 8 bytes at any address. id() (a permitted builtin) supplies arbitrary object addresses.
Arbitrary write: cell = c_long.from_address(addr); cell.value = X writes 8 bytes to any address. The write half rides asteval's unfiltered setattr in Interpreter.node_assign (the ast.Attribute branch performs setattr(self.run(node.value), node.attr, val) with no attribute-name check).

Root cause is two gaps:

safe_getattr blocks the ctypes module but not ctypes types / metaclass methods (from_address, from_buffer, from_buffer_copy, in_dll, from_param) reachable via ndarray.ctypes ... ._type_.
node_assign performs attribute writes (setattr) and deletes (delattr) with no attribute-name filtering.

This belongs to the known "numpy is a large attack surface" class (the docs already note open() read and ndarray.tofile() write), but this specific arbitrary memory read/write chain is undocumented and bypasses the most recent ctypes-module hardening. All previously reported escapes (CVE-2025-24359 / GHSA-3wwr-3g9f-9gc7, GHSA-vp47-9734-prjw, reduce/reduce_ex, classic __subclasses__ traversal) are patched on the current code; this one is live.

PoC

Self contained POC here: https://gist.github.com/thegr1ffyn/16b67c5f9b5339a7e2bdc91423ff09e3 Environment: pip install asteval numpy (verified on asteval 1.0.8, numpy 2.4.6, CPython 3.12.3; the chain is numpy-1.x/2.x robust). Default Interpreter (use_numpy=True, import disabled).

Minimal one-expression arbitrary read (reads 8 bytes at an attacker-chosen address):

zeros(1,dtype=int32).ctypes.shape._type_.from_address(id(zeros(1))).value

Minimal arbitrary write (writes 0x4142434445464748 to a chosen address; here our own array buffer, observed back through numpy):

a = zeros(2, dtype=int32)
cell = a.ctypes.shape._type_.from_address(a.ctypes.data)
cell.value = 0x4142434445464748        # -> a[0]=0x45464748, a[1]=0x41424344

A full self-contained script is attached (poc_asteval_ctypes.py); running it prints the recovered PyObject header of a private object (arbitrary read) and confirms a raw write landing at a chosen pointer (arbitrary write), all from a default, import-disabled interpreter.

Impact

Sandbox escape / protection-mechanism failure leading to arbitrary in-process native memory read and write (RCE-equivalent). Impact:

Disclosure of any data in the host process's address space (secrets, keys, other users' data).
Corruption of arbitrary memory -> control-flow hijack / arbitrary code execution and/or process crash (DoS).

Affected: any application that evaluates untrusted/attacker-influenced expressions with asteval while numpy is installed (the default). No authentication and no special configuration is required; import does not need to be enabled. Mitigation until patched: construct the interpreter with use_numpy=False.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "asteval"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-693",
      "CWE-749",
      "CWE-913"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T17:26:52Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nWith its default configuration (numpy enabled, `import` disabled), asteval\u0027s `Interpreter` lets an attacker-controlled expression obtain a raw **arbitrary process-memory read and write** primitive, without using `import`, any `__dunder__` attribute, or `eval`/`exec`/`getattr`. Arbitrary in-process read/write is equivalent to arbitrary code execution and is a complete escape of the sandbox whose entire purpose is \"untrusted string in, no arbitrary execution out.\" Any application that feeds untrusted input to asteval with numpy installed (the default) is affected.\n\n### Details\nasteval\u0027s attribute filter (`asteval/astutils.py: safe_getattr`) blocks every `__dunder__` name and blocks objects whose attribute value is *identity-equal* to one of the modules in `UNSAFE_MODULES = {io, os, sys, ctypes}`. The `ctypes` **module** entry was added recently (commit 9d9d430) and correctly blocks `ndarray.ctypes._ctypes`.\n\nHowever, the module check is identity-only against the ctypes *module*. It does not cover ctypes **type objects** and their metaclass methods, which are reachable through numpy\u0027s `ndarray.ctypes` wrapper using only ordinary (non-dunder) attribute names:\n\n    zeros(1, dtype=int32).ctypes.shape._type_      -\u003e  \u003cclass \u0027ctypes.c_long\u0027\u003e\n\n`ndarray.ctypes` exposes `.shape` (a ctypes array) whose element type `._type_` is `ctypes.c_long`. None of `ctypes`, `.shape`, `._type_` is a dunder, none is in `UNSAFE_ATTRS`, and the returned value is a *type*, not the ctypes module, so `safe_getattr` permits all of them.\n\nOn that ctypes type, the metaclass method `from_address` is reachable (non-dunder, not in `UNSAFE_ATTRS`; it is not even listed by `dir()`, which is likely why it was missed):\n\n* **Arbitrary read:** `c_long.from_address(addr).value` reads 8 bytes at any address. `id()` (a permitted builtin) supplies arbitrary object addresses.\n* **Arbitrary write:** `cell = c_long.from_address(addr); cell.value = X` writes 8 bytes to any address. The write half rides asteval\u0027s **unfiltered `setattr`** in `Interpreter.node_assign` (the `ast.Attribute` branch performs `setattr(self.run(node.value), node.attr, val)` with no attribute-name check).\n\nRoot cause is two gaps:\n\n1. `safe_getattr` blocks the ctypes *module* but not ctypes *types* / metaclass methods (`from_address`, `from_buffer`, `from_buffer_copy`, `in_dll`, `from_param`) reachable via `ndarray.ctypes ... ._type_`.\n2. `node_assign` performs attribute writes (`setattr`) and deletes (`delattr`) with no attribute-name filtering.\n\nThis belongs to the known \"numpy is a large attack surface\" class (the docs already note `open()` read and `ndarray.tofile()` write), but this specific arbitrary memory read/write chain is undocumented and bypasses the most recent ctypes-module hardening. All previously reported escapes (CVE-2025-24359 / GHSA-3wwr-3g9f-9gc7, GHSA-vp47-9734-prjw, reduce/reduce_ex, classic `__subclasses__` traversal) are patched on the current code; this one is live.\n\n### PoC\nSelf contained POC here: https://gist.github.com/thegr1ffyn/16b67c5f9b5339a7e2bdc91423ff09e3\nEnvironment: `pip install asteval numpy` (verified on asteval 1.0.8, numpy 2.4.6, CPython 3.12.3; the chain is numpy-1.x/2.x robust). Default `Interpreter` (`use_numpy=True`, `import` disabled).\n\nMinimal one-expression arbitrary read (reads 8 bytes at an attacker-chosen address):\n\n    zeros(1,dtype=int32).ctypes.shape._type_.from_address(id(zeros(1))).value\n\nMinimal arbitrary write (writes 0x4142434445464748 to a chosen address; here our own array buffer, observed back through numpy):\n\n    a = zeros(2, dtype=int32)\n    cell = a.ctypes.shape._type_.from_address(a.ctypes.data)\n    cell.value = 0x4142434445464748        # -\u003e a[0]=0x45464748, a[1]=0x41424344\n\nA full self-contained script is attached (poc_asteval_ctypes.py); running it prints the recovered PyObject header of a private object (arbitrary read) and confirms a raw write landing at a chosen pointer (arbitrary write), all from a default, import-disabled interpreter.\n\n### Impact\nSandbox escape / protection-mechanism failure leading to arbitrary in-process native memory read and write (RCE-equivalent). Impact:\n\n* Disclosure of any data in the host process\u0027s address space (secrets, keys, other users\u0027 data).\n* Corruption of arbitrary memory -\u003e control-flow hijack / arbitrary code execution and/or process crash (DoS).\n\nAffected: any application that evaluates untrusted/attacker-influenced expressions with asteval while numpy is installed (the default). No authentication and no special configuration is required; `import` does not need to be enabled. Mitigation until patched: construct the interpreter with `use_numpy=False`.",
  "id": "GHSA-9w56-46f6-3qhx",
  "modified": "2026-08-20T17:26:52Z",
  "published": "2026-08-20T17:26:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lmfit/asteval/pull/153"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lmfit/asteval"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lmfit/asteval/releases/tag/1.0.9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-102734 (GCVE-0-2026-102734)

FKIE_CVE-2026-102734

GHSA-9W56-46F6-3QHX

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour