CVE-2026-32640: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes in danthedeckie simpleeval
SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.
AI Analysis
Technical Summary
The vulnerability CVE-2026-32640 in danthedeckie's simpleeval library (versions prior to 1.0.5) stems from improper control of dynamically-determined object attributes (CWE-915). This flaw allows objects passed into simpleeval to leak access to dangerous modules or functions within the sandbox, including via callbacks to otherwise safe functions. The issue enables unauthorized access to potentially harmful code execution paths. The vulnerability has a CVSS 4.0 score of 8.7 (high severity) and is fixed in version 1.0.5. Vendor advisories from Red Hat confirm the fix and provide guidance for remediation.
Potential Impact
Exploitation of this vulnerability could allow an attacker to bypass sandbox restrictions in simpleeval, gaining access to dangerous modules or functions that should be disallowed. This could lead to unauthorized code execution within the context of the Python application using simpleeval. The CVSS score of 8.7 indicates a high impact with network attack vector, no privileges or user interaction required, and high impact on integrity.
Mitigation Recommendations
Upgrade simpleeval to version 1.0.5 or later, where this vulnerability is fixed. The vendor advisory confirms that the issue is resolved in this version. No additional mitigations are specified or required once the update is applied.
CVE-2026-32640: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes in danthedeckie simpleeval
Description
SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.
CVSS v4.0
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-32640 in danthedeckie's simpleeval library (versions prior to 1.0.5) stems from improper control of dynamically-determined object attributes (CWE-915). This flaw allows objects passed into simpleeval to leak access to dangerous modules or functions within the sandbox, including via callbacks to otherwise safe functions. The issue enables unauthorized access to potentially harmful code execution paths. The vulnerability has a CVSS 4.0 score of 8.7 (high severity) and is fixed in version 1.0.5. Vendor advisories from Red Hat confirm the fix and provide guidance for remediation.
Potential Impact
Exploitation of this vulnerability could allow an attacker to bypass sandbox restrictions in simpleeval, gaining access to dangerous modules or functions that should be disallowed. This could lead to unauthorized code execution within the context of the Python application using simpleeval. The CVSS score of 8.7 indicates a high impact with network attack vector, no privileges or user interaction required, and high impact on integrity.
Mitigation Recommendations
Upgrade simpleeval to version 1.0.5 or later, where this vulnerability is fixed. The vendor advisory confirms that the issue is resolved in this version. No additional mitigations are specified or required once the update is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-12T15:29:36.560Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-32640","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:10184","vendor":"Red Hat"}]
Threat ID: 69b481d42f860ef943b5ebbd
Added to database: 03/13/2026, 21:29:56 UTC
Last enriched: 07/18/2026, 14:42:49 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 250
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.