The asteval library versions before 1.0.9 improperly handle certain BaseException subclasses (BaseException, SystemExit, KeyboardInterrupt, GeneratorExit) raised during evaluation of expressions. While the eval() and run() methods catch Exception, they do not catch these non-Exception subclasses. When such exceptions are raised by attacker-controlled expressions, they bypass the interpreter's safety mechanisms and propagate into the host application, potentially causing termination or disruption of cleanup processes. This vulnerability can be exploited to cause denial of service in applications that evaluate untrusted expressions. The vulnerability is addressed in asteval version 1.0.9.

An attacker able to supply expressions to an application using vulnerable versions of asteval can cause the application to terminate unexpectedly or disrupt its signal and cleanup handling. This leads to denial of service. There is no impact on confidentiality or integrity. The vulnerability requires local or limited privileges (AV:L, PR:L) and user interaction (UI:R).

Upgrade to asteval version 1.0.9 or later, where this issue is fixed. No other mitigation is indicated or required.