---
id: CVE-2026-55244
title: ASTEVAL is an evaluator of Python expressions and statements
summary: >-
  ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9,
  FROM_PY in asteval/astutils.py exposes BaseException, SystemExit,
  KeyboardInterrupt, and GeneratorExit to expressions evaluated by
  asteval.Interpreter.eval(), …
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H'
cwe:
  - CWE-248
vendor: lmfit
product: asteval
affected:
  - asteval < 1.0.9
patched:
  - asteval 1.0.9
published: '2026-09-14'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T17:17:21.253'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55244'
references:
  - url: >-
      https://github.com/lmfit/asteval/commit/9c625b3674f8d05f206708bb85afca17a87694a4
    label: security-advisories@github.com
  - url: >-
      https://github.com/lmfit/asteval/commit/c49c99a67acb63eb7410231932250bd820380e45
    label: security-advisories@github.com
  - url: 'https://github.com/lmfit/asteval/pull/153'
    label: security-advisories@github.com
  - url: 'https://github.com/lmfit/asteval/releases/tag/1.0.9'
    label: security-advisories@github.com
  - url: 'https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77'
    label: security-advisories@github.com
  - url: 'https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4
  - url: 'https://github.com/lmfit/asteval'
  - url: 'https://pypi.org/project/asteval'
  - url: 'https://github.com/advisories/GHSA-89v8-rhwq-hf77'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55244'
tags:
  - nvd
  - cve.org
  - osv
  - pip
  - ghsa
  - exploit-available
epss: 0.00177
epssPercentile: 0.06495
aliases:
  - GHSA-89v8-rhwq-hf77
  - PYSEC-2026-3807
ecosystem: pip
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-16T16:17:25.234532Z'
ingestedAt: '2026-08-20T17:59:05.868Z'
---

## Overview

ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Interpreter.eval(), while run() and eval() in asteval/asteval.py catch Exception rather than these non-Exception BaseException subclasses. When an attacker-controlled expression raises one of these classes, on_raise() passes the class to raise_exception(), and the resulting exception bypasses the interpreter's safety handlers and propagates into the calling application. A consuming service that evaluates untrusted expressions can therefore be terminated or have signal and cleanup handling disrupted, causing denial of service. The separately documented read-only open() capability is not part of this vulnerability. This issue is fixed in version 1.0.9.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55244)

Affected packages:

- `asteval < 1.0.9`

Patched in:

- `asteval 1.0.9`

Source: https://osv.dev/vulnerability/GHSA-89v8-rhwq-hf77