CVE-2026-102734

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102734
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102734.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102734
Aliases
Published
2026-10-13T15:29:49Z
Modified
2026-10-14T10:30:55Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
Details

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-693",
        "CWE-749",
        "CWE-913"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102734.json"
}
References

Affected packages

Git / github.com/lmfit/asteval

Affected ranges

Type
GIT
Repo
https://github.com/lmfit/asteval
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0b359d0b03195d1288af656e98730ab691b04f5a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.0.9"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*
0.9
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.3.1
0.9.30
0.9.31
0.9.32
0.9.33
0.9.4
0.9.5
0.9.6
0.9.7
0.9.9
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102734.json"