CVE-2026-102734: asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits fromaddress memory access. safegetattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safesetattr. An attacker-controlled expression can derive an address with id, read memory through fromaddress, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
astevalto a version that resolves this vulnerability.Fixed in 1.0.9
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the default asteval Interpreter with numpy enabled are exposed if they run a version prior to 1.0.9 and evaluate attacker-controlled expressions. The vulnerable behavior is reachable through ctypes type objects exposed despite blocking the ctypes module itself.
What does an attacker need to exploit this issue?
An attacker needs the ability to supply an expression for evaluation by the affected Interpreter. No prior privileges are required, but user interaction is required according to the supplied severity vector.
What can exploitation do to the host process?
An attacker-controlled expression can derive an address using id, use from_address to read memory, and use attribute assignment to write memory. This can disclose secrets, corrupt process memory, execute code, or crash the host process.
What is the remediation?
Upgrade asteval to version 1.0.9, which fixes this issue. The provided data does not specify an alternative mitigation for environments that cannot immediately upgrade.