Code Execution Vulnerability in Lupa Integrated with CPython
CVE-2026-34444
7.9HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-34444?
The Lupa library, which integrates Lua or LuaJIT into CPython, has a significant vulnerability where the attribute_filter is not consistently enforced for attributes accessed via built-in functions such as getattr and setattr in versions 2.6 and earlier. This inconsistency permits attackers to circumvent intended access controls, ultimately leading to possibilities for arbitrary code execution within the environment.
Affected Version(s)
lupa <= 2.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.