CVE-2026-32640

The impact of CVE-2026-32640 is significant, as it allows for complete remote code execution. An attacker can leverage this vulnerability to gain control of the affected system, potentially leading to data theft, system compromise, and further lateral movement within the network. The vulnerability stems from SimpleEval's insufficient validation of input objects. Specifically, if the names parameter contains objects with attributes that expose access to the operating system (e.g., os.path, shutil, numpy.ctypeslib.os), an attacker can chain these attributes to execute arbitrary commands. The discovery by @ByamB4 highlights the ease with which this can be achieved, demonstrating the potential for widespread exploitation.

Applications that utilize SimpleEval to evaluate user-provided expressions, particularly those deployed in environments where user input is not thoroughly validated, are at significant risk. This includes applications that dynamically generate code or configurations based on user input, as well as those that use SimpleEval for sandboxed scripting or evaluation of untrusted data.

• python / library:

import simpleeval
import inspect
# Check for vulnerable versions
import pkg_resources
version = pkg_resources.get_distribution('simpleeval').version
if version in ['1.0.0', '1.0.1', '1.0.2', '1.0.3', '1.0.4']:
    print("Vulnerable SimpleEval version detected!")
    # Inspect objects passed to SimpleEval for potentially dangerous attributes
    # This is a simplified example and requires more robust analysis

• generic web: Review application code that utilizes SimpleEval to identify potential injection points where malicious objects could be passed to the library.

1. 2026-03-13Disclosure

   disclosure

1. Reserviert2026-03-12
2. Veröffentlicht2026-03-13
3. Geändert2026-04-21
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-32640 is to upgrade to SimpleEval version 1.0.5 or later, which includes the necessary fixes. If upgrading is not immediately feasible, consider implementing input validation to restrict the objects passed to SimpleEval. Specifically, whitelist allowed modules and attributes, preventing the use of potentially dangerous ones like os and sys. While a WAF is unlikely to directly mitigate this vulnerability, careful input sanitization within the application using SimpleEval could provide an additional layer of defense. After upgrading, confirm the fix by attempting to execute a SimpleEval expression with a known malicious object and verifying that it is properly blocked.