Executive brief
Perspective is an interactive analytics and data visualization engine widely used in banking and trading dashboards. A critical flaw in version 5.0.0 allows unauthenticated attackers to execute arbitrary commands on the server by submitting specially crafted expression strings. An attacker can gain full control of the host system running Perspective, compromising all data and operations relying on that server.
Technical details
The vulnerability is an unsafe use of Python's eval() function in the PolarsVirtualServer backend (perspective-python). The parse_expression function at line 710 of rust/perspective-python/perspective/virtual_servers/polars.py performs only a regex substitution on user-supplied expression strings before passing them directly to eval() with __builtins__={} as the only sandboxing attempt. This defense is insufficient; attackers bypass it using Python object attribute traversal (e.g., ().__class__.__bases__[0].__subclasses__()) to access subprocess.Popen. The vulnerability is reachable unauthenticated via TableValidateExprReq or TableMakeViewReq protobuf messages over the WebSocket protocol. No user interaction or authentication is required; expression validation alone is sufficient to trigger code execution.
Affected products
- Perspective Perspective <=5.0.0
Timeline
- 2026-08-04: disclosed
- 2026-07-30: other: Live analysis published by researcher Christ Bowel