asteval 0.9.13

Direct Vulnerabilities

Known vulnerabilities in the asteval package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Improper Control of Dynamically-Managed Code Resources asteval is a Safe, minimalistic evaluator of python expression using ast module Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources through the `Interpreter` process when evaluating attacker-controlled expressions with numpy enabled. An attacker can read and write arbitrary process memory by leveraging accessible ctypes type metaclass methods via numpy's `ndarray.ctypes` wrapper, bypassing attribute filters and exploiting unfiltered attribute assignment. This can lead to disclosure of sensitive data, memory corruption, arbitrary code execution, or process crash. This is only exploitable if untrusted input is evaluated with numpy installed and enabled, and import is disabled by default. How to fix Improper Control of Dynamically-Managed Code Resources? Upgrade `asteval` to version 1.0.9 or higher.	[,1.0.9)
M Uncaught Exception asteval is a Safe, minimalistic evaluator of python expression using ast module Affected versions of this package are vulnerable to Uncaught Exception via the `eval` process. An attacker can terminate the application process or disrupt signal and cleanup handlers by supplying specially crafted expressions that raise subclasses of `BaseException` not caught by standard exception handling. How to fix Uncaught Exception? Upgrade `asteval` to version 1.0.9 or higher.	[,1.0.9)
H Exposed Dangerous Method or Function asteval is a Safe, minimalistic evaluator of python expression using ast module Affected versions of this package are vulnerable to Exposed Dangerous Method or Function through the `on_formattedvalue` function. An attacker can manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)` to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. How to fix Exposed Dangerous Method or Function? Upgrade `asteval` to version 1.0.6 or higher.	[,1.0.6)
H Exposed Dangerous Method or Function asteval is a Safe, minimalistic evaluator of python expression using ast module Affected versions of this package are vulnerable to Exposed Dangerous Method or Function stems from the library's attribute access verification method, specifically within the `on_attribute` node handler. The handler is intended to block access to sensitive Python dunder methods by checking against a list of unsafe attributes and attribute patterns. However, due to a flaw in the implementation, an attacker can manipulate the attribute access mechanism by altering the attribute name during runtime, thereby bypassing the safety checks and executing arbitrary code. How to fix Exposed Dangerous Method or Function? Upgrade `asteval` to version 1.0.6 or higher.	[,1.0.6)
H Improper Isolation or Compartmentalization asteval is a Safe, minimalistic evaluator of python expression using ast module Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization. It is possible to escape the `asteval` sandbox using `reduce` and `reduce_ex`. How to fix Improper Isolation or Compartmentalization? Upgrade `asteval` to version 0.9.23 or higher.	[,0.9.23)

Vulnerability

Vulnerable Version

Improper Control of Dynamically-Managed Code Resources