Is there a public PoC exploit available for CVE-2026-32640?

Yes, a public proof-of-concept exploit is available for CVE-2026-32640. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-32640?

Within 24 hours: Inventory all applications and dependencies using SimpleEval and assess whether untrusted input is evaluated. Within 7 days: Upgrade SimpleEval to version 1.0.5 or later where available, or implement compensating controls if upgrade is blocked. Within 30 days: Conduct security testing of affected applications and update any custom expression evaluators to incorporate ModuleWrapper protections equivalent to version 1.0.5.

CVE-2026-32640

Q: What is the CVSS score of CVE-2026-32640?

CVE-2026-32640 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12142 HIGH

Code Injection (CWE-94)

2026-03-13 https://github.com/danthedeckie/simpleeval

GHSA-44vg-5wv2-h2hg

RCE Code Injection

8.7

CVSS 4.0 · Vendor: https://github.com/danthedeckie/simpleeval

Severity by source

Vendor (https://github.com/danthedeckie/simpleeval) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (https://github.com/danthedeckie/simpleeval).

CVSS VectorVendor: https://github.com/danthedeckie/simpleeval

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Apr 21, 2026 - 16:22 NVD

CRITICAL HIGH

CVSS changed

Apr 21, 2026 - 16:22 NVD

9.8 (CRITICAL) 8.7 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 18, 2026 - 18:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 13, 2026 - 21:01 euvd

EUVD-2026-12142

Analysis Generated

Mar 13, 2026 - 21:01 vuln.today

CVE Published

Mar 13, 2026 - 20:56 nvd

CRITICAL 9.8

DescriptionCVE.org

Impact

If the objects passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call.

Examples (found by @ByamB4):

Any module where non-underscore attribute chains reach os or sys:

os.path, pathlib, shutil, glob (direct .os / .sys attributes)
statistics (has .sys)
numpy (has .ctypeslib.os and .f2py.sys)
urllib.parse (has .warnings.sys)

Patches

The latest version 1.0.5 has this issue fixed.

Workarounds

Don't pass in objects or modules which have direct attributes to potentially dangerous items. Use a wrapper to wrap the potentially vulnerable items (See the ModuleWrapper in version 1.0.5)