CVE-2026-55244
Received Received - Intake

ASTEVAL BaseException Handling Flaw Enables DoS

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Interpreter.eval(), while run() and eval() in asteval/asteval.py catch Exception rather than these non-Exception BaseException subclasses. When an attacker-controlled expression raises one of these classes, on_raise() passes the class to raise_exception(), and the resulting exception bypasses the interpreter's safety handlers and propagates into the calling application. A consuming service that evaluates untrusted expressions can therefore be terminated or have signal and cleanup handling disrupted, causing denial of service. The separately documented read-only open() capability is not part of this vulnerability. This issue is fixed in version 1.0.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-55244

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
asteval asteval 1.0.9
lmfit asteval to 1.0.9 (exc)
lmfit asteval 1.0.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55244 is a sandbox escape vulnerability in the asteval library versions 1.0.6 and earlier. It allows attackers to raise dangerous BaseException subclasses like SystemExit, KeyboardInterrupt, or GeneratorExit through user-controlled expressions. These exceptions bypass the library's safety handlers and propagate to the calling application, potentially terminating the process or disrupting cleanup operations.

Detection Guidance

Check if your system uses asteval versions 1.0.6 or earlier. Run: pip show asteval. If version is <=1.0.6, the system is vulnerable. Also inspect code for untrusted expression evaluation using asteval.Interpreter.eval().

Impact Analysis

If you use asteval to evaluate untrusted expressions, this vulnerability could allow attackers to terminate your application by raising SystemExit. It may also disrupt signal handlers, cleanup operations, or generator cleanup, leading to denial of service or unexpected behavior in your application.

Mitigation Strategies

Upgrade asteval to version 1.0.9 or later. If upgrading is not possible, modify FROM_PY in astutils.py to remove BaseException subclasses like SystemExit and GeneratorExit. Alternatively, catch BaseException in run() and eval() methods.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55244. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart