{"id":"CVE-2026-32640","aliases":["GHSA-44vg-5wv2-h2hg","PYSEC-2026-132"],"url":"https://o3.security/vulnerability/CVE-2026-32640","summary":"(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.","details":"### Impact\nIf the objects passed in as `names` to SimpleEval have modules or other disallowed / dangerous objects available as attrs.\nAdditionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call.\n\nExamples (found by @ByamB4):\n\nAny module where non-underscore attribute chains reach os or sys:\n- os.path, pathlib, shutil, glob (direct .os / .sys attributes)\n- statistics (has .sys)\n- numpy (has .ctypeslib.os and .f2py.sys)\n- urllib.parse (has .warnings.sys)\n\n### Patches\nThe latest version 1.0.5 has this issue fixed.\n\n### Workarounds\nDon't pass in objects or modules which have direct attributes to potentially dangerous items.\nUse a wrapper to wrap the potentially vulnerable items (See the ModuleWrapper in version 1.0.5)","published":"2026-03-13T21:03:53.435Z","modified":"2026-08-12T03:51:23.731771225Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"simpleeval","fixedVersion":"1.0.5"}],"fix":null,"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/04/msg00023.html"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32640.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-32640"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32640.json"},{"type":"ADVISORY","url":"https://github.com/danthedeckie/simpleeval/security/advisories/GHSA-44vg-5wv2-h2hg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32640"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447529"},{"type":"PACKAGE","url":"https://github.com/danthedeckie/simpleeval"},{"type":"WEB","url":"https://github.com/danthedeckie/simpleeval/releases/tag/1.0.5"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/simpleeval/PYSEC-2026-132.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:23.731771225Z"}}