Python Expression Evaluator Vulnerability in Asteval from LMFit

CVE-2026-102734

What is CVE-2026-102734?

The Asteval Python expression evaluator has a vulnerability allowing attackers to exploit the default Interpreter with numpy enabled. This issue permits access to ctypes types and memory addresses via from_address, potentially leading to unauthorized memory reading and writing. Attackers may utilize this flaw to escape the system's sandbox, execute arbitrary code, corrupt process memory, and disclose sensitive information. The vulnerability was addressed in version 1.0.9, preventing unfiltered attribute assignments and enhancing security against such exploits.

References