{"id":"CVE-2026-55244","title":"ASTEVAL is an evaluator of Python expressions and statements","summary":"ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Interpreter.eval(), …","severity":"medium","cvss":5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","cwe":["CWE-248"],"vendor":"lmfit","product":"asteval","affected":["asteval < 1.0.9"],"patched":["asteval 1.0.9"],"published":"2026-09-14","updated":"2026-09-16","sourceUpdated":"2026-09-16T17:17:21.253","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55244","references":[{"url":"https://github.com/lmfit/asteval/commit/9c625b3674f8d05f206708bb85afca17a87694a4","label":"security-advisories@github.com"},{"url":"https://github.com/lmfit/asteval/commit/c49c99a67acb63eb7410231932250bd820380e45","label":"security-advisories@github.com"},{"url":"https://github.com/lmfit/asteval/pull/153","label":"security-advisories@github.com"},{"url":"https://github.com/lmfit/asteval/releases/tag/1.0.9","label":"security-advisories@github.com"},{"url":"https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77","label":"security-advisories@github.com"},{"url":"https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4"},{"url":"https://github.com/lmfit/asteval"},{"url":"https://pypi.org/project/asteval"},{"url":"https://github.com/advisories/GHSA-89v8-rhwq-hf77"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55244"}],"tags":["nvd","cve.org","osv","pip","ghsa","exploit-available"],"epss":0.00191,"epssPercentile":0.08979,"aliases":["GHSA-89v8-rhwq-hf77","PYSEC-2026-3807"],"ecosystem":"pip","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-16T16:17:25.234532Z"},"ingestedAt":"2026-08-20T17:59:05.868Z","slug":"CVE-2026-55244","body":"## Overview\n\nASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Interpreter.eval(), while run() and eval() in asteval/asteval.py catch Exception rather than these non-Exception BaseException subclasses. When an attacker-controlled expression raises one of these classes, on_raise() passes the class to raise_exception(), and the resulting exception bypasses the interpreter's safety handlers and propagates into the calling application. A consuming service that evaluates untrusted expressions can therefore be terminated or have signal and cleanup handling disrupted, causing denial of service. The separately documented read-only open() capability is not part of this vulnerability. This issue is fixed in version 1.0.9.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55244)\n\nAffected packages:\n\n- `asteval < 1.0.9`\n\nPatched in:\n\n- `asteval 1.0.9`\n\nSource: https://osv.dev/vulnerability/GHSA-89v8-rhwq-hf77","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":205577,"id":"CVE-2026-55244","ts":1789578062175,"field":"exploit_available","old":"false","new":"true"}]}