Executive brief
Lupa is a software library that allows Python programs to run Lua code. A security flaw in how it restricts access to sensitive data allows an attacker who can run Lua scripts to bypass security boundaries. This could lead to the attacker taking full control of the host system and executing unauthorized commands.
Technical details
Lupa, which integrates Lua/LuaJIT2 into CPython, fails to consistently enforce the 'attribute_filter' when attributes are accessed via Python built-in functions such as getattr() and setattr(). While direct attribute access (e.g., obj.attr) is filtered, an attacker can use getattr(obj, 'attr') to bypass these restrictions. By accessing sensitive internal attributes like __class__ and traversing the Method Resolution Order (MRO) to find __subclasses__(), an attacker can reach execution primitives such as os.system. This vulnerability allows for a complete sandbox escape and arbitrary command execution in the host Python process, particularly if the environment allows access to Python builtins.
Affected products
- scoder Lupa <= 2.6
- Red Hat Red Hat Satellite 6.18 6.18
Timeline
- 2026-04-05: advisory: GitHub Security Advisory published by scoder
- 2026-04-06: disclosed: CVE-2026-34444 published
- 2026-06-03: advisory: Red Hat Security Advisory RHSA-2026:22993 issued