CVE-2026-102734: 
Python 脆弱性の分析と軽減

CVE-2026-102734 is a sandbox escape vulnerability in asteval, a Python expression evaluator by lmfit designed for restricted execution. In versions prior to 1.0.9, the default Interpreter (with numpy enabled) exposes ctypes type objects and permits arbitrary native memory read/write via from_address, allowing an attacker-controlled expression to escape the sandbox, execute code, disclose secrets, or crash the host process. The vulnerability was disclosed on June 11, 2026 via GitHub Security Advisory GHSA-9w56-46f6-3qhx and published to NVD on October 13, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is a protection mechanism failure (CWE-693) combining an exposed dangerous method (CWE-749) and improper control of dynamically-managed code resources (CWE-913). safe_getattr in asteval/astutils.py blocks the ctypes module by identity check but does not block ctypes type objects reachable through numpy's ndarray.ctypes wrapper — for example, zeros(1, dtype=int32).ctypes.shape._type_ yields ctypes.c_long, none of whose attribute names are dunders or listed in UNSAFE_ATTRS. Additionally, the node_assign handler performs attribute writes via unfiltered setattr rather than safe_setattr, enabling arbitrary memory writes. An attacker can use the permitted id() builtin to obtain object addresses, then call from_address for arbitrary reads and perform attribute assignment for arbitrary writes — all without using import, dunder attributes, or eval/exec (GitHub Advisory). A public PoC is available at https://gist.github.com/thegr1ffyn/16b67c5f9b5339a7e2bdc91423ff09e3, verified on asteval 1.0.8, numpy 2.4.6, CPython 3.12.3 (GitHub Advisory).

Successful exploitation grants an attacker arbitrary in-process native memory read and write primitives, which is functionally equivalent to arbitrary code execution. An attacker can disclose any data in the host process's address space (secrets, cryptographic keys, other users' data), corrupt memory to hijack control flow, or crash the host process (denial of service). Any application that evaluates untrusted or attacker-influenced expressions with asteval while numpy is installed — the default configuration — is affected, with no authentication or special configuration required (GitHub Advisory).

A public proof-of-concept exploit script (poc_asteval_ctypes.py) was published by the reporter (thegr1ffyn) alongside the advisory, demonstrating both arbitrary read and write primitives in a self-contained script (GitHub Advisory). No in-the-wild exploitation has been reported as of the disclosure date, and the EPSS score is 0.0 (Feedly). The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the target application passes attacker-controlled input to an asteval Interpreter with numpy installed, which is the default setup.

1. Identify target: Locate an application that passes attacker-controlled strings to an asteval Interpreter with numpy installed (the default configuration, use_numpy=True, import disabled).
2. Obtain a ctypes type object: Craft an expression that traverses numpy's ndarray.ctypes wrapper to reach a ctypes type — e.g., zeros(1, dtype=int32).ctypes.shape._type_ — which safe_getattr permits because none of the attribute names are dunders or in UNSAFE_ATTRS, and the returned value is a type, not the ctypes module itself.
3. Arbitrary memory read: Use the permitted id() builtin to obtain the address of a target Python object, then call from_address on the ctypes type to read 8 bytes at that address: zeros(1,dtype=int32).ctypes.shape._type_.from_address(id(target_object)).value.
4. Arbitrary memory write: Create a ctypes object pointing to a chosen address and exploit the unfiltered setattr in node_assign to write an arbitrary value: cell = a.ctypes.shape._type_.from_address(a.ctypes.data); cell.value = 0x4142434445464748.
5. Achieve objective: Use the read/write primitive to corrupt Python object internals (e.g., function pointers, type structures) to redirect execution, exfiltrate in-memory secrets, or crash the process (GitHub Advisory).

• Logs: Application logs showing evaluation of expressions containing .ctypes.shape._type_, from_address, or id( passed to asteval; unexpected AttributeError or RuntimeError messages from asteval in application logs.
• Process Behavior: Unexpected crashes or memory corruption errors in Python processes using asteval with numpy; unusual process behavior such as unexpected data output or segmentation faults originating from the asteval interpreter.
• File System: Presence of poc_asteval_ctypes.py or similar PoC scripts on the system; unexpected files written via ndarray.tofile() or ndarray.dump() if those vectors were also attempted.

Upgrade asteval to version 1.0.9, which adds ctypes, dump, and tofile as unsafe attributes of numpy ndarray objects, preventing traversal to ctypes type objects (GitHub Release). The fix also removes SystemExit and GeneratorExit from the symbol table and adds explicit BaseException handling throughout the interpreter (GitHub PR #153). As an immediate workaround for those unable to upgrade, construct the interpreter with use_numpy=False to eliminate the attack surface entirely (GitHub Advisory).

The vulnerability was reported by security researcher thegr1ffyn, who provided a detailed write-up and self-contained PoC in the GitHub advisory (GitHub Advisory). The asteval maintainer (newville) acknowledged the issue and merged the fix (PR #153) on June 11, 2026, the same day the advisory was published, noting it also addressed a related advisory (GHSA-89v8-rhwq-hf77) (GitHub PR #153). The NixOS security tracker referenced the issue in September 2026 in the context of packaging updates (GitHub PR #153).