CVE-2026-32640: SimpleEval Module Access Vulnerability Leading to Potential Security Risks
Summary
CVE-2026-32640: Impact If the objects passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Affects simpleeval versions < 1.0.5. Fixed in 1.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleEval is a Python library that allows for the evaluation of simple expressions in a controlled environment, often used for safely executing user-defined expressions. However, it has been found to have vulnerabilities that allow access to dangerous modules and functions, which can compromise the security of applications using this library.
Vulnerability Detail
The vulnerability arises when objects passed to SimpleEval contain attributes that link to dangerous modules such as os or sys. This can lead to unauthorized access to system-level functions and data, posing significant security risks. For instance, modules like os.path and urllib.parse can expose sensitive system information through their attributes, allowing malicious users to execute harmful operations.
How To Fix
Minimum fixed version
1.0.5
This is the first release that contains the fix.
pip install --upgrade "simpleeval==1.0.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid passing objects or modules that have direct attributes leading to potentially dangerous items. You can use a wrapper to encapsulate vulnerable items. For example, you can implement a ModuleWrapper as follows:
class ModuleWrapper:
def __init__(self, module):
self.module = module
def __getattr__(self, attr):
if attr in ['os', 'sys']:
raise AttributeError('Access to this attribute is restricted.')
return getattr(self.module, attr)
Conclusion
The SimpleEval vulnerability (CVE-2026-32640) poses significant security risks by allowing access to dangerous modules through user-defined expressions. It is crucial to update to the patched version 1.0.5 or implement workarounds to mitigate these risks.
See every vulnerability recorded for simpleeval →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
The risks include unauthorized access to system-level functions and data, which can lead to data breaches or system compromise.
Yes, the vulnerability has been patched in version 1.0.5 of the SimpleEval package.
If immediate updates are not possible, implement the suggested workarounds to limit exposure to the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for simpleeval.
