asteval CVE-2026-102734

Requires asteval prior to 1.0.9 running its DEFAULT Interpreter with numpy installed/enabled (the default when numpy is present) and import disabled, where the host application passes an attacker-controlled expression string to Interpreter.eval(). No authentication to the sandbox, no user interaction, and no use of import, __dunder__ attributes, eval/exec, or getattr are needed - the chain uses only ordinary attribute access (ndarray.ctypes.shape._type_), the permitted id() builtin, ctypes from_address, and an ordinary attribute assignment. LIMITING FACTORS: exploitation is impossible if numpy is absent or the application never feeds untrusted input to asteval, and it is remediated entirely by upgrading to 1.0.9; the realistic attack surface (and effective attack vector) depends on how the consuming application exposes the expression input.

Signals conflict sharply and that conflict is the headline. The vendor CVSS is 5.5 (medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - i.e. it was scored as a local, availability-only (crash/DoS) issue, which is reinforced by the 'Denial Of Service' tag. The GHSA advisory, however, documents a complete sandbox escape yielding an arbitrary in-process memory READ and WRITE primitive, explicitly equated to arbitrary code execution, secret disclosure, and memory corruption. That means the C:N/I:N portion of the vendor vector materially understates true impact (real impact is C:H/I:H/A:H), and the vulnerability should be triaged well above its 5.5 label for any environment that actually feeds untrusted expressions to asteval. Mitigating the alarm: no EPSS score was provided, there is no CISA KEV listing, and no evidence of active exploitation - so this is NOT a confirmed mass-exploited internet-facing bug. Its risk is sharply conditional: it only matters where an application passes attacker-controlled strings into asteval's default Interpreter with numpy present. SSVC inputs (exploitation/automatable/technical-impact) were not supplied. Net: a genuine high-priority sandbox escape for affected consumers despite the deceptively moderate CVSS, but not a drop-everything internet-wide emergency. The AV:L / UI:R choice is questionable - the sandbox's entire purpose is accepting untrusted (frequently remote) input, so verify the real attack surface per deployment.

An application exposes a formula/expression field (e.g. a web calculator, report builder, or config evaluator) that passes user input to asteval's default Interpreter with numpy installed. An attacker submits a crafted expression that walks from a numpy array's .ctypes.shape._type_ to a ctypes c_long type, then uses the permitted id() builtin plus c_long.from_address(...).value to read arbitrary process memory and an unfiltered attribute assignment to write it. The GHSA advisory publishes the exact working technique, so a reliable, deterministic (AC:L) exploit requires no import, dunder, eval/exec, or getattr.