CVE-2026-67195 is a remote code execution vulnerability in perspective-dev's Perspective product, affecting versions up to and including 5.0.0. The vulnerability arises because the PolarsVirtualServer backend passes client-supplied input directly to Python's eval() function with only __builtins__={} cleared, insufficiently restricting the execution environment. Attackers can exploit Python object attribute traversal through the interpreter's loaded class list to reach subprocess.Popen via specific protobuf messages (TableValidateExprReq or TableMakeViewReq), enabling arbitrary OS command execution in the host process.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary operating system commands on the Perspective host, potentially leading to full system compromise. The vulnerability has a high CVSS 4.0 score of 8.7, reflecting its critical impact on confidentiality, integrity, and availability without requiring user interaction or privileges beyond network access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Perspective service and monitor for suspicious activity related to protobuf message handling. Avoid exposing the PolarsVirtualServer backend to untrusted networks.