Lupa, a Python package integrating Lua or LuaJIT2 runtimes into CPython, suffers from an improper access control vulnerability (CWE-284) in versions 2.6 and earlier. The attribute_filter intended to restrict attribute access is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This flaw enables attackers to bypass these restrictions and may lead to arbitrary code execution. The vulnerability has a CVSS 4.0 base score of 7.9, indicating high severity. No patch or official remediation guidance is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to bypass attribute access restrictions and execute arbitrary code within the affected environment. This could compromise the confidentiality, integrity, and availability of the system running the vulnerable lupa version. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable versions of lupa and monitor for updates from the vendor. Avoid using lupa versions 2.6 and earlier in untrusted environments.