| Package | Affected versions | Patched versions |
|---|---|---|
| simpleeval | < 1.0.5 | 1.0.5 |
| simpleeval | < 1.0.5 | 1.0.5 |
If the objects passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs.
Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call.
Examples (found by @ByamB4):
Any module where non-underscore attribute chains reach os or sys:
The latest version 1.0.5 has this issue fixed.
Don't pass in objects or modules which have direct attributes to potentially dangerous items. Use a wrapper to wrap the potentially vulnerable items (See the ModuleWrapper in version 1.0.5)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free