Executive Summary

CVE-2026-32640 is a security vulnerability in the Python package SimpleEval versions prior to 1.0.5. The issue occurs because objects, including modules, passed into SimpleEval can leak access to dangerous modules inside the sandbox environment.

If the objects passed as names to SimpleEval have attributes that reference disallowed or dangerous modules (such as os or sys), an attacker can exploit these attribute chains to gain unauthorized access to those modules.

Additionally, dangerous functions or modules can be accessed by passing them as callbacks to otherwise safe functions, further increasing the risk.

This vulnerability was fixed in SimpleEval version 1.0.5 by introducing protections such as the ModuleWrapper to encapsulate potentially vulnerable items and prevent unauthorized access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to gain unauthorized access to dangerous modules within the SimpleEval sandbox, potentially leading to execution of harmful operations.

By exploiting attribute chains, an attacker could access modules like os or sys, which might enable them to manipulate the file system, execute system commands, or interfere with the running environment.

Such unauthorized access can compromise the security and integrity of your application, leading to data breaches, system compromise, or other malicious activities.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves the SimpleEval Python package leaking access to dangerous modules through objects passed into its sandbox environment. Detection involves inspecting your Python projects that use SimpleEval versions prior to 1.0.5 to see if any objects or modules with dangerous attributes (such as os, sys, or their derivatives) are passed into SimpleEval.'}, {'type': 'paragraph', 'content': 'There are no specific network detection commands provided, but you can audit your codebase for usage of SimpleEval and check the version.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect vulnerable versions and usage in your environment include:'}, {'type': 'list_item', 'content': 'Check installed SimpleEval version: `pip show simpleeval`'}, {'type': 'list_item', 'content': 'Search your codebase for SimpleEval usage: `grep -r "import simpleeval" ./` or `grep -r "SimpleEval" ./`'}, {'type': 'list_item', 'content': 'Review code where objects with attributes referencing modules like os, sys, pathlib, shutil, glob, statistics, numpy, or urllib.parse are passed into SimpleEval.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade SimpleEval to version 1.0.5 or later, where this vulnerability is fixed.

If upgrading immediately is not possible, avoid passing objects or modules with direct attributes to dangerous items (such as os, sys, and their derivatives) into SimpleEval.

Alternatively, use the ModuleWrapper introduced in version 1.0.5 to encapsulate potentially vulnerable items and prevent unauthorized access.

Useful 0 Not Useful 0