8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32640

CVE-2026-32640: (SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32640

CVE-2026-32640:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
simpleeval	pip	< 1.0.5	1.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the simpleeval library's failure to properly sanitize the objects returned during the evaluation of an expression. The root cause is in the SimpleEval._eval method. Before the patch, this method would evaluate a part of the expression (a node) and return the resulting object without any security checks. This allowed an attacker to craft an expression that, when evaluated, would return a reference to a Python module (like os) or a dangerous function that was inadvertently passed into the sandbox environment via the names dictionary. The returned object could then be used to perform malicious actions. The patch introduces a new function, _check_disallowed_items, which recursively inspects objects for modules and forbidden functions. This check is now called within _eval on the result of every node evaluation, effectively closing the vulnerability by preventing dangerous objects from being leaked back to the expression evaluator.

Vulnerable functions

SimpleEval._eval

simpleeval.py

The `_eval` function is the core evaluation function in simpleeval. Before the patch, it would return the result of an expression node evaluation without checking if the result itself was a dangerous object, such as a module or a disallowed function. An attacker could craft an expression that resolves to a dangerous object, which `_eval` would then return, allowing for sandbox escape and potential arbitrary code execution in a subsequent operation. The patch adds a check (`_check_disallowed_items`) to the return value of the node handler to prevent this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.