asteval 0.9.33 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the asteval package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Exposed Dangerous Method or Function asteval is a Safe, minimalistic evaluator of python expression using ast module Affected versions of this package are vulnerable to Exposed Dangerous Method or Function through the `on_formattedvalue` function. An attacker can manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)` to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. How to fix Exposed Dangerous Method or Function? Upgrade `asteval` to version 1.0.6 or higher.	[,1.0.6)
H Exposed Dangerous Method or Function asteval is a Safe, minimalistic evaluator of python expression using ast module Affected versions of this package are vulnerable to Exposed Dangerous Method or Function stems from the library's attribute access verification method, specifically within the `on_attribute` node handler. The handler is intended to block access to sensitive Python dunder methods by checking against a list of unsafe attributes and attribute patterns. However, due to a flaw in the implementation, an attacker can manipulate the attribute access mechanism by altering the attribute name during runtime, thereby bypassing the safety checks and executing arbitrary code. How to fix Exposed Dangerous Method or Function? Upgrade `asteval` to version 1.0.6 or higher.	[,1.0.6)

Vulnerability

Vulnerable Version

Exposed Dangerous Method or Function

asteval is a Safe, minimalistic evaluator of python expression using ast module

Affected versions of this package are vulnerable to Exposed Dangerous Method or Function through the on_formattedvalue function. An attacker can manipulate the value of the string used in the dangerous call fmt.format(__fstring__=val) to access protected attributes by intentionally triggering an AttributeError exception. The attacker can then catch the exception and use its obj attribute to gain arbitrary access to sensitive or protected object properties.

How to fix Exposed Dangerous Method or Function?

Upgrade asteval to version 1.0.6 or higher.

[,1.0.6)

Exposed Dangerous Method or Function

asteval is a Safe, minimalistic evaluator of python expression using ast module

Affected versions of this package are vulnerable to Exposed Dangerous Method or Function stems from the library's attribute access verification method, specifically within the on_attribute node handler. The handler is intended to block access to sensitive Python dunder methods by checking against a list of unsafe attributes and attribute patterns. However, due to a flaw in the implementation, an attacker can manipulate the attribute access mechanism by altering the attribute name during runtime, thereby bypassing the safety checks and executing arbitrary code.

How to fix Exposed Dangerous Method or Function?

Upgrade asteval to version 1.0.6 or higher.

[,1.0.6)

asteval@0.9.33 vulnerabilities

Safe, minimalistic evaluator of python expression using ast module

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically