asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

published 2026-08-20 2 mo ago modified 2026-10-16 23 d ago also GHSA-9w56-46f6-3qhx , EUVD-2026-98813

cvss: 5.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits: 0; none known

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9.

Patch / fix

fixed in 1 links 3

pypi asteval 1.0.9

github.com/lmfit/asteval@a3e56e7 commit
github.com/lmfit/asteval#153 pull request
github.com/lmfit/asteval/releases/tag/1.0.9 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 26 d ago (2026-10-13)

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
GitHub	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	asteval	<1.0.9	1.0.9

Affected products

lmfit asteval

Classification

Weakness

CWE-693 Protection Mechanism Failure
CWE-749 Exposed Dangerous Method or Function
CWE-913 Improper Control of Dynamically-Managed Code Resources

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary