p PatchFirst

CVE-2026-32640

CVE-2026-32640 · (SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.

This page contains facts from public vulnerability sources. Check the original advisory before updating.

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

CVSS 8.7 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • simpleeval

    Versions
    • < 1.0.5: Affected

    No fix published

  • simpleeval Debian:12

    Versions
    • 0.9.12-1
    Affected ranges
    • ECOSYSTEM: < 0.9.12-1+deb12u1

    Update to 0.9.12-1+deb12u1

  • simpleeval Debian:13

    Versions
    • 1.0.3-1
    Affected ranges
    • ECOSYSTEM: < 1.0.3-1+deb13u1

    Update to 1.0.3-1+deb13u1

  • simpleeval Debian:14

    Versions
    • 1.0.3-1
    Affected ranges
    • ECOSYSTEM: < 1.0.7-1

    Update to 1.0.7-1

  • simpleeval PyPI

    Versions
    • 0.8.1
    • 0.8.2
    • 0.8.5
    • 0.8.6
    • 0.8.7
    • 0.9.0
    • 0.9.1
    • 0.9.10
    • 0.9.11
    • 0.9.12
    • 0.9.13
    • 0.9.2
    • 0.9.3
    • 0.9.4
    • 0.9.5
    • 0.9.6
    • 0.9.7
    • 0.9.8
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.0.4
    Affected ranges
    • ECOSYSTEM: < 1.0.5

    Update to 1.0.5

  • simpleeval Ubuntu:Pro:16.04:LTS

    Versions
    • 0.8.5-1
    • 0.8.7-1
    Affected ranges
    • ECOSYSTEM: < 0.8.7-1ubuntu0.1~esm1

    Update to 0.8.7-1ubuntu0.1~esm1

  • simpleeval Ubuntu:Pro:18.04:LTS

    Versions
    • 0.9.3-1
    • 0.9.5-1
    Affected ranges
    • ECOSYSTEM: < 0.9.5-1ubuntu0.1~esm1

    Update to 0.9.5-1ubuntu0.1~esm1

  • simpleeval Ubuntu:Pro:20.04:LTS

    Versions
    • 0.9.6-1
    • 0.9.6-2
    • 0.9.10-0ubuntu1
    • 0.9.10-1
    Affected ranges
    • ECOSYSTEM: < 0.9.10-1+deb11u1build0.20.04.1

    Update to 0.9.10-1+deb11u1build0.20.04.1

  • simpleeval Ubuntu:Pro:22.04:LTS

    Versions
    • 0.9.10-1
    • 0.9.11-1
    Affected ranges
    • ECOSYSTEM: < 0.9.11-1ubuntu0.1~esm1

    Update to 0.9.11-1ubuntu0.1~esm1

  • simpleeval Ubuntu:24.04:LTS

    Versions
    • 0.9.12-1
    Affected ranges
    • ECOSYSTEM: < 0.9.12-1+deb12u1build0.24.04.1

    Update to 0.9.12-1+deb12u1build0.24.04.1

  • simpleeval Ubuntu:25.10

    Versions
    • 1.0.3-1
    Affected ranges
    • ECOSYSTEM: < 1.0.3-1+deb13u1build0.25.10.1

    Update to 1.0.3-1+deb13u1build0.25.10.1

  • simpleeval Ubuntu:26.10

    Versions
    • 1.0.3-1build1
    • 1.0.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • simpleeval Ubuntu:26.04:LTS

    Versions
    • 1.0.3-1
    • 1.0.3-1build1
    Affected ranges
    • ECOSYSTEM: < 1.0.3-1+deb13u1build0.26.04.1

    Update to 1.0.3-1+deb13u1build0.26.04.1

Original sources

Check your server →