Critical Vulnerability in SimpleEval Package: Module Leakage Risk
Summary
DEBIAN-CVE-2026-32640: SimpleEval is a library for adding evaluatable expressions into python projects. Affects simpleeval versions 0.9.10-1 – 1.0.3-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleEval is a Python library designed to facilitate the evaluation of expressions within projects, allowing developers to safely execute dynamic code. It provides a sandboxed environment for evaluating expressions, which is crucial for applications that require user-generated input. However, prior to version 1.0.5, SimpleEval had a significant vulnerability that allowed objects, including dangerous modules, to be accessed directly within the sandbox, posing a security risk.
Vulnerability Detail
The vulnerability arises from the way SimpleEval handles objects passed into its evaluation context. Prior to version 1.0.5, if these objects contained references to disallowed or dangerous modules, they could be accessed directly, leading to potential exploitation. This could allow an attacker to execute arbitrary code or access sensitive information, undermining the security of applications that rely on SimpleEval for expression evaluation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider restricting the objects passed to SimpleEval to ensure they do not contain references to dangerous modules or functions. Additionally, review the code to avoid using callbacks that could lead to the execution of unsafe code.
Conclusion
The SimpleEval package has a critical vulnerability that allows access to dangerous modules through its evaluation context. Updating to version 1.0.5 or later is essential to mitigate this risk. In the meantime, implementing strict controls on input can help protect applications from potential exploitation.
See every vulnerability recorded for simpleeval →
FAQ
The vulnerability allows dangerous modules to be accessed through objects passed into the SimpleEval sandbox, potentially leading to code execution.
If your application uses SimpleEval versions prior to 1.0.5, it is likely affected. You can check using the Vulert playground without signup.
Failing to address this vulnerability could lead to unauthorized code execution, data breaches, or other security incidents.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file.
Implement strict controls on the objects passed to SimpleEval and avoid using unsafe callbacks until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for simpleeval.
