THREAT OPS › Threat News › [GHSA] GHSA-89v8-rhwq-hf77 (medium) — asteval has a Sandbox Escape via BaseException Subclasses
[GHSA] GHSA-89v8-rhwq-hf77 (medium) — asteval has a Sandbox Escape via BaseException Subclasses
GHSA-89v8-rhwq-hf77 Severity: medium CVE: CVE-2026-55244
asteval has a Sandbox Escape via BaseException Subclasses
## Summary
An attacker who can supply expressions to `asteval.Interpreter.eval()` can raise `SystemExit`, `KeyboardInterrupt`, `GeneratorExit`, or `BaseException` from inside the sandbox. These exceptions are subclasses of `BaseException` but not `Exception`, so they bypass the `ex
MITRE ATT&CK techniques
Indicators of compromise
- CVE-2026-55244cve
- CVE-2025-24359cve
- https://docs.python.org/3/library/exceptions.html#exception-hierarchyurl
- https://lmfit.github.io/asteval/url
Original source: https://github.com/advisories/GHSA-89v8-rhwq-hf77