CVE-2026-55244: 
Python vulnerability analysis and mitigation

CVE-2026-55244 is a sandbox escape vulnerability in the Python asteval library (pip package) that allows an attacker who can supply expressions to asteval.Interpreter.eval() to raise SystemExit, KeyboardInterrupt, GeneratorExit, or BaseException from inside the sandbox, bypassing the library's except Exception: safety net and propagating the exception to the calling application. It affects all versions of asteval prior to 1.0.9, including the previously patched 1.0.6. The vulnerability was discovered on June 9, 2026, reported via GitHub Security Advisory, and the fix was published on June 11, 2026; the advisory was formally published to the GitHub Advisory Database on August 20, 2026. It carries a CVSS v3.1 base score of 5.0 (Medium) (GitHub Advisory, lmfit Advisory).

The root cause (CWE-248: Uncaught Exception) lies in asteval/astutils.py, where the FROM_PY tuple exposes dangerous Python built-in classes — BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit — to sandbox users. These classes are subclasses of BaseException but not Exception, so they are not caught by the except Exception: guards in both run() (line 322) and eval() (line 370) of asteval/asteval.py. When a sandboxed user writes raise SystemExit("msg"), the on_raise() handler calls self.raise_exception(None, exc=out.__class__, msg=msg, expr=''), which executes raise SystemExit(msg) — this propagates unchecked through all safety handlers and surfaces in the calling application. This vector is distinct from prior vulnerabilities CVE-2025-24359 (format string injection) and GHSA-vp47-9734-prjw (AST mutation TOCTOU), both fixed in 1.0.6, and was present in all versions including 1.0.6 (GitHub Advisory, lmfit Advisory).

The primary impact is a Denial of Service (DoS) against the hosting application: a SystemExit raise terminates the process with an attacker-controlled exit code and message, KeyboardInterrupt disrupts finally blocks and signal handlers, GeneratorExit disrupts generator cleanup in calling code, and a raw BaseException escapes generically. There is no confidentiality or integrity impact from this specific vector, though the advisory separately notes that asteval's read-only open() wrapper allows reading arbitrary files accessible to the calling process (a documented design limitation, not a separate CVE claim). Any application that accepts user-supplied expressions via asteval and relies on standard except Exception: top-level handlers — without the non-standard except BaseException: — is vulnerable to attacker-triggered process termination (GitHub Advisory, lmfit Advisory).

A public proof-of-concept is included in the GitHub Security Advisory itself, demonstrating all four exploit variants (SystemExit, KeyboardInterrupt, GeneratorExit, BaseException) confirmed on asteval 1.0.6 with Python 3.11/3.12. No evidence of in-the-wild exploitation or threat actor attribution has been reported. The CVE status was listed as "Reserved" at time of Feedly ingestion, and no EPSS score or CISA KEV catalog entry is available for this vulnerability (GitHub Advisory, lmfit Advisory).

1. Identify a target application: Find an application that accepts user-supplied expressions and passes them to asteval.Interpreter.eval() — such as a web service, scientific computing platform, or formula evaluator using asteval < 1.0.9.
2. Craft a malicious expression: Prepare a payload using one of the exposed dangerous exception classes, e.g., raise SystemExit("terminated by sandbox user"), raise KeyboardInterrupt("interrupt injected"), raise GeneratorExit("gen escape"), or raise BaseException("base escape").
3. Submit the expression: Deliver the payload through whatever input mechanism the application exposes (e.g., HTTP request body, form field, API parameter) that feeds into aeval.eval().
4. Exception escapes sandbox: The on_raise() handler in asteval calls raise SystemExit(msg) (or equivalent), which bypasses the except Exception: guards in both run() and eval() and propagates to the calling application.
5. Achieve DoS: The calling application's top-level except Exception: handler does not catch the exception; the process terminates (for SystemExit) or signal/cleanup handlers are disrupted (for KeyboardInterrupt/GeneratorExit) (GitHub Advisory, lmfit Advisory).

• Logs: Unexpected process termination events in application logs with attacker-controlled exit messages (e.g., SystemExit: terminated by sandbox user); abrupt absence of log entries following an expression evaluation request.
• Process: Application process exits unexpectedly or with a non-zero exit code immediately after processing a user-supplied expression; finally blocks or cleanup handlers not executing as expected.
• Application Behavior: Web service or API becomes unresponsive or restarts unexpectedly after receiving expression input; generator-based pipelines silently abort mid-execution.
• Input Data: User-supplied expressions containing keywords SystemExit, KeyboardInterrupt, GeneratorExit, or BaseException in expression fields or API parameters (GitHub Advisory).

Upgrade to asteval 1.0.9 (released June 11, 2026), which removes SystemExit and GeneratorExit from the FROM_PY symbol table and adds explicit except (KeyboardInterrupt, SystemExit, GeneratorExit) handlers in run(), eval(), parse(), import_module(), and on_call() that convert these to RuntimeError, preventing sandbox escape (asteval Release 1.0.9, Fix PR #153). As a temporary workaround for applications that cannot immediately upgrade, wrap all calls to aeval.eval() in except BaseException: rather than except Exception:. OpenSUSE Tumbleweed users should apply the available distribution package update (OpenSUSE Advisory).

The asteval maintainer (newville) responded promptly, opening and merging fix PR #153 on the same day the vulnerability was reported (June 9–11, 2026) and releasing version 1.0.9 with explicit acknowledgment of the security advisory GHSA-89v8-rhwq-hf77 (Fix PR #153, asteval Release 1.0.9). OpenSUSE issued a security announcement for Tumbleweed users, and the vulnerability was picked up by Linux compatibility news outlets (OpenSUSE Advisory). No significant broader media coverage or notable researcher commentary beyond the original reporter (mhamzakhattak) has been identified.