CVE-2026-32640: 
Python vulnerability analysis and mitigation

CVE-2026-32640 is a sandbox escape vulnerability in the Python library SimpleEval that allows attackers to access dangerous system modules (such as os and sys) through improperly controlled object attribute chains, enabling arbitrary code execution. It affects all versions of simpleeval prior to 1.0.5 (pip package). The vulnerability was discovered by researcher @ByamB4, disclosed and patched on March 13, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-94 (Code Injection) and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). SimpleEval is designed to safely evaluate Python expressions in a sandboxed context, but it fails to restrict attribute traversal on objects passed in as named variables. An attacker can traverse attribute chains on seemingly safe modules — for example, os.path, pathlib, shutil, glob, statistics (which has .sys), numpy (which has .ctypeslib.os and .f2py.sys), and urllib.parse (which has .warnings.sys) — to reach os or sys and execute arbitrary code. Additionally, dangerous functions or modules can be accessed by passing them as callbacks to other safe functions within the evaluated expression (GitHub Advisory, simpleeval Release 1.0.5).

Successful exploitation allows an attacker to escape the SimpleEval sandbox and execute arbitrary code on the host system with the privileges of the running process. This can result in full system compromise, including unauthorized access to sensitive data (confidentiality breach), modification of system files or application data (integrity violation), and potential disruption of services (availability impact). Because no authentication or user interaction is required and the attack vector is network-accessible, any application that exposes SimpleEval expression evaluation to untrusted input is at risk of complete remote compromise (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.052% (17th percentile), indicating a currently low probability of exploitation within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity, no authentication requirement, and network accessibility make it a high-priority patching target for any application exposing SimpleEval to untrusted input.

1. Reconnaissance: Identify applications that use the simpleeval Python library (versions < 1.0.5) and expose expression evaluation to user-controlled input — e.g., web applications with formula or expression fields.
2. Identify injectable input: Locate the parameter or field that is passed to SimpleEval.eval() or equivalent, where attacker-controlled strings are evaluated as expressions.
3. Craft attribute-chain payload: Construct an expression that traverses a permitted object's attributes to reach os or sys. For example, if urllib.parse is passed as a name, craft an expression like urllib.parse.warnings.sys.modules['os'].system('id').
4. Alternatively, use callback abuse: Pass a dangerous function as a callback to a safe function within the evaluated expression to trigger execution of arbitrary code.
5. Achieve code execution: The injected expression is evaluated by SimpleEval without proper attribute restriction, resulting in execution of arbitrary OS commands under the application's process privileges, enabling data exfiltration, reverse shell establishment, or further lateral movement (GitHub Advisory, simpleeval Release 1.0.5).

• Logs: Application logs showing unusual or complex attribute-chain expressions submitted to expression evaluation endpoints (e.g., strings containing .warnings.sys, .ctypeslib.os, .f2py.sys, or direct os.system/subprocess references).
• Process: Unexpected child processes spawned by the Python application process (e.g., /bin/sh, bash, curl, wget, python) that are not part of normal application behavior.
• Network: Outbound connections from the application server to unknown external IPs, particularly on non-standard ports, following expression evaluation requests.
• File System: Unexpected new files, scripts, or cron jobs created by the application's service account; web shells or backdoors placed in application directories.

Upgrade simpleeval to version 1.0.5 or later, which fixes this vulnerability by preventing modules and submodules from being directly usable as names or as attributes of other items (simpleeval Release 1.0.5). As a workaround for those unable to upgrade immediately, avoid passing objects or modules that have direct attribute chains to potentially dangerous items (os, sys) into SimpleEval's names parameter; use the new ModuleWrapper class introduced in 1.0.5 to safely wrap modules if module access is required (GitHub Advisory). Additionally, implement strict input validation and consider network segmentation to limit the blast radius of any potential exploitation.

The vulnerability was credited to researcher @ByamB4, who discovered the attribute-chain bypass technique affecting multiple common Python modules (GitHub Advisory). The issue was picked up by Red Hat's security team and tracked in their Bugzilla, and OpenSUSE and Debian issued security advisories for their packaged versions of python-simpleeval. Social media activity was observed on Bluesky and Mastodon shortly after disclosure, and the vulnerability was covered by Linux security news outlets including LinuxSecurity.com.