Bug#1150909: python-asteval: CVE-2026-102734

[Moritz Mühlenhoff]

Source: python-asteval
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for python-asteval.

CVE-2026-102734[0]:
| asteval is a Python expression evaluator designed for restricted
| execution. Prior to 1.0.9, in asteval/astutils.py, the default
| Interpreter with numpy enabled exposes a ctypes type and permits
| from_address memory access. safe_getattr blocks the ctypes module
| but not reachable ctypes type objects, while attribute assignments
| use unfiltered setattr instead of safe_setattr. An attacker-
| controlled expression can derive an address with id, read memory
| through from_address, and write through an attribute assignment. The
| expression can read or corrupt arbitrary process memory, escape the
| intended sandbox, execute code, disclose secrets, or crash the host
| process. This issue is fixed in version 1.0.9.

https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx
https://github.com/lmfit/asteval/pull/153
Fixed by (merge): https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4 (1.0.9)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-102734
    https://www.cve.org/CVERecord?id=CVE-2026-102734

Please adjust the affected versions in the BTS as needed.