CVE-2026-32640

此漏洞允许攻击者绕过SimpleEval的沙箱机制，直接访问Python环境中的危险模块。攻击者可以利用这些模块执行恶意代码，例如读取敏感数据、修改系统配置或执行远程代码。由于SimpleEval常用于安全上下文，例如评估用户提供的表达式，因此该漏洞的潜在影响非常严重。攻击者可以利用此漏洞获取对受保护系统的完全控制权，造成严重的安全风险。类似的安全漏洞可能导致数据泄露和系统被破坏。

Applications that utilize SimpleEval to evaluate user-provided expressions, particularly those deployed in environments where user input is not thoroughly validated, are at significant risk. This includes applications that dynamically generate code or configurations based on user input, as well as those that use SimpleEval for sandboxed scripting or evaluation of untrusted data.

• python / library:

import simpleeval
import inspect
# Check for vulnerable versions
import pkg_resources
version = pkg_resources.get_distribution('simpleeval').version
if version in ['1.0.0', '1.0.1', '1.0.2', '1.0.3', '1.0.4']:
    print("Vulnerable SimpleEval version detected!")
    # Inspect objects passed to SimpleEval for potentially dangerous attributes
    # This is a simplified example and requires more robust analysis

• generic web: Review application code that utilizes SimpleEval to identify potential injection points where malicious objects could be passed to the library.

1. 2026-03-13Disclosure

   disclosure

1. 已保留2026-03-12
2. 发布日期2026-03-13
3. 修改日期2026-04-21
4. EPSS 更新日期2026-03-23

最有效的缓解措施是立即升级到SimpleEval 1.0.5或更高版本。如果无法立即升级，可以考虑限制SimpleEval沙箱中允许访问的模块。可以通过修改SimpleEval的配置来禁止访问特定的模块或目录。此外，应仔细审查传递给SimpleEval的输入，确保其不包含任何恶意代码。如果无法升级，请考虑使用更严格的沙箱环境，例如使用更安全的Python解释器或限制SimpleEval的权限。