Every CVE Search/ Get API key

CVE-2026-32640

(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.

8.7 HighFix available

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.59%Up 0.5 points since Mar 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

Record
CVE-2026-32640
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-915, CWE-94, CWE-915
Updated
2026-11-02
EUVDEUVD-2026-12142 8.7

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

Record
EUVD-2026-12142
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-44vg-5wv2-h2hg 8.7

SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox

Impact

If the objects passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call.

Examples (found by @ByamB4):

Any module where non-underscore attribute chains reach os or sys:

  • os.path, pathlib, shutil, glob (direct .os / .sys attributes)
  • statistics (has .sys)
  • numpy (has .ctypeslib.os and .f2py.sys)
  • urllib.parse (has .warnings.sys)

Patches

The latest version 1.0.5 has this issue fixed.

Workarounds

Don't pass in objects or modules which have direct attributes to potentially dangerous items. Use a wrapper to wrap the potentially vulnerable items (See the ModuleWrapper in version 1.0.5)

Record
GHSA-44vg-5wv2-h2hg
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94, CWE-915
Updated
2026-11-02
NVD 8.7

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

Record
CVE-2026-32640
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-94, CWE-915
Updated
2026-11-02
OSV 8.7

(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

Record
CVE-2026-32640
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-915, CWE-94
Updated
2026-11-02
OSVDEBIAN-CVE-2026-32640 9.8

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

Record
DEBIAN-CVE-2026-32640
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-44vg-5wv2-h2hg 8.7

SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox

Impact

If the objects passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call.

Examples (found by @ByamB4):

Any module where non-underscore attribute chains reach os or sys:

  • os.path, pathlib, shutil, glob (direct .os / .sys attributes)
  • statistics (has .sys)
  • numpy (has .ctypeslib.os and .f2py.sys)
  • urllib.parse (has .warnings.sys)

Patches

The latest version 1.0.5 has this issue fixed.

Workarounds

Don't pass in objects or modules which have direct attributes to potentially dangerous items. Use a wrapper to wrap the potentially vulnerable items (See the ModuleWrapper in version 1.0.5)

Record
GHSA-44vg-5wv2-h2hg
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-915, CWE-94
Updated
2026-11-02
OSVPYSEC-2026-132 9.8

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

Record
PYSEC-2026-132
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-32640 8.7

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

Record
UBUNTU-CVE-2026-32640
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:10373-1 No score

python311-simpleeval-1.0.5-1.1 on GA media

These are all security issues fixed in the python311-simpleeval-1.0.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10373-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20393-1 No score

Security update for python-simpleeval

This update for python-simpleeval fixes the following issues:

Changes in python-simpleeval:

  • CVE-2026-32640: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox (bsc#1259685)
Record
openSUSE-SU-2026:20393-1
Updated
2026-11-02
OSVUSN-8301-1 No score

simpleeval vulnerability

Byambadalai Sumiya discovered that SimpleEval did not properly restrict attribute access and callback handling inside a sandbox. An attacker could possibly use this issue to execute arbitrary code.

Record
USN-8301-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
simpleeval
PyPI
 before 1.0.5
1.0.5
simpleeval
Debian:12
 before 0.9.12-1+deb12u1, plus listed versions
0.9.12-1
0.9.12-1+deb12u1
simpleeval
Debian:13
 before 1.0.3-1+deb13u1, plus listed versions
1.0.3-1
1.0.3-1+deb13u1
simpleeval
Debian:14
 before 1.0.7-1, plus listed versions
1.0.3-1
1.0.7-1
simpleeval
PyPI
 before 1.0.5, plus listed versions
0.8.10.8.20.8.50.8.60.8.7
Show 18 moreShow less
0.9.00.9.10.9.100.9.110.9.120.9.130.9.20.9.30.9.40.9.50.9.60.9.70.9.81.0.01.0.11.0.21.0.31.0.4
1.0.5
simpleeval
Ubuntu:Pro:16.04:LTS
 before 0.8.7-1ubuntu0.1~esm1, plus listed versions
0.8.5-10.8.7-1
0.8.7-1ubuntu0.1~esm1
simpleeval
Ubuntu:Pro:18.04:LTS
 before 0.9.5-1ubuntu0.1~esm1, plus listed versions
0.9.3-10.9.5-1
0.9.5-1ubuntu0.1~esm1
simpleeval
Ubuntu:Pro:20.04:LTS
 before 0.9.10-1+deb11u1build0.20.04.1, plus listed versions
0.9.6-10.9.6-20.9.10-0ubuntu10.9.10-1
0.9.10-1+deb11u1build0.20.04.1
simpleeval
Ubuntu:Pro:22.04:LTS
 before 0.9.11-1ubuntu0.1~esm1, plus listed versions
0.9.10-10.9.11-1
0.9.11-1ubuntu0.1~esm1
simpleeval
Ubuntu:24.04:LTS
 before 0.9.12-1+deb12u1build0.24.04.1, plus listed versions
0.9.12-1
0.9.12-1+deb12u1build0.24.04.1
Show 5 moreShow less
Affected packages
PackageAffectedFixed
simpleeval
Ubuntu:25.10
 before 1.0.3-1+deb13u1build0.25.10.1, plus listed versions
1.0.3-1
1.0.3-1+deb13u1build0.25.10.1
simpleeval
Ubuntu:26.10
 All versions, plus listed versions
1.0.3-1build11.0.7-1
 None known
simpleeval
Ubuntu:26.04:LTS
 before 1.0.3-1+deb13u1build0.26.04.1, plus listed versions
1.0.3-11.0.3-1build1
1.0.3-1+deb13u1build0.26.04.1
python-simpleeval
openSUSE:Tumbleweed
 before 1.0.5-1.1
1.0.5-1.1
python-simpleeval
openSUSE:Leap 16.0
 before 0.9.13-bp160.2.1
0.9.13-bp160.2.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-32640 is a high vulnerability (CVSS 8.7) in Danthedeckie Simpleeval, published March 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in simpleeval 1.0.5.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open