Threats affecting pkg:pypi/asteval

A vulnerability in the Python expression evaluator asteval prior to version 1.0.9 allows an attacker to bypass sandbox restrictions. The issue arises because the default Interpreter with numpy enabled exposes a ctypes type and permits memory access via from_address. This enables an attacker-controlled expression to read or write arbitrary process memory, potentially crashing the host or disclosing secrets. The vulnerability is fixed in version 1.0.9.

A vulnerability in the asteval Python expression evaluator prior to version 1.0.9 allows certain BaseException subclasses (BaseException, SystemExit, KeyboardInterrupt, GeneratorExit) raised by attacker-controlled expressions to bypass the interpreter's safety handlers. This can cause the consuming application to terminate unexpectedly or disrupt signal and cleanup handling, resulting in denial of service. The issue is fixed in version 1.0.9.