Executive brief
asteval is a Python expression evaluator used to safely execute untrusted mathematical expressions with a sandbox. This vulnerability bypasses the sandbox's core protection mechanism, allowing attackers to read and write arbitrary memory in the host process through numpy's ctypes interface. An attacker who can supply input expressions to asteval can leak sensitive data (secrets, keys) or corrupt memory to achieve code execution—completely defeating the sandbox's purpose.
Technical details
The vulnerability is a sandbox escape in asteval's expression evaluator caused by two protection gaps. First, the `safe_getattr` attribute filter blocks the ctypes module itself but fails to block ctypes type objects (like `ctypes.c_long`) and their metaclass methods (`from_address`, `from_buffer`, etc.) which are reachable through numpy arrays' `.ctypes` interface without using dunder names. Second, `node_assign` (the attribute assignment handler) performs `setattr` operations with no attribute-name filtering. An attacker chains `ndarray.ctypes.shape._type_.from_address(addr)` to create a ctypes object at an arbitrary address, then uses `.value` to read (or `setattr` via unfiltered assignment to write) 8 bytes. The `id()` builtin supplies object addresses. No import statement, eval/exec, or dunder access is required. All versions of asteval < 1.0.9 with numpy installed are affected.
Affected products
- lmfit asteval < 1.0.9
Timeline
- 2026-06-11: disclosed
- 2026-06-11: patched: Patched in version 1.0.9