Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2026-102734: asteval up to 1.0.8 lets attackers read/write memory
CVE-2026-102734 · published 22 days ago
Summary
The asteval expression tool (versions before 1.0.9) can be tricked into exposing a low‑level memory function, allowing anyone who can supply code to read or change any data in the running program. This could let an attacker steal secrets, run unwanted code, or crash the application. Upgrade to version 1.0.9 or later to close the gap.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| lmfit | asteval | < 1.0.9 |
Original advisory text
asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-693Protection Mechanism Failure
CWE-749Exposed Dangerous Method or Function
CWE-913Improper Control of Dynamically-Managed Code Resources
Timeline
Published13 Oct 2026
Updated26 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta