Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-32640

32
FAUCET Score

CVE-2026-32640 identifies a critical sandbox escape vulnerability in the SimpleEval Python library, affecting versions prior to 1.0.5. This flaw allows dangerous modules or objects to be accessed within the sandbox, either through direct attribute access on passed-in objects or via callbacks to safe functions. Rated 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it permits remote, unauthenticated attackers to achieve full confidentiality, integrity, and availability compromise. Despite its severity, there is currently no evidence of active exploitation, nor are public exploit codes available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, and it is not listed on the CISA KEV catalog.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.0.5CPE matchmatch criteria
cpe:2.3:a:danthedeckie:simpleeval:*:*:*:*:*:python:*:*

CVSS Data

CVSS version used by this source: 4.0

8.7HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
HIGH
VS Availability
NONE
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.52%
Probability of exploitation in next 30 days
EPSS Percentile
41.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0052 is in the 20th percentile among its peer group of 36,862 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (8)

pippatch availablevia ghsa
Product: simpleevalFixed in: 1.0.5
ubuntupatch availablevia ubuntu_usn
Product: simpleeval (bionic)Fixed in: 0.9.5-1ubuntu0.1~esm1
ubuntupatch availablevia ubuntu_usn
Product: simpleeval (focal)Fixed in: 0.9.10-1+deb11u1build0.20.04.1
ubuntupatch availablevia ubuntu_usn
Product: simpleeval (jammy)Fixed in: 0.9.11-1ubuntu0.1~esm1
ubuntupatch availablevia ubuntu_usn
Product: simpleeval (noble)Fixed in: 0.9.12-1+deb12u1build0.24.04.1
ubuntupatch availablevia ubuntu_usn
Product: simpleeval (questing)Fixed in: 1.0.3-1+deb13u1build0.25.10.1
ubuntupatch availablevia ubuntu_usn
Product: simpleeval (resolute)Fixed in: 1.0.3-1+deb13u1build0.26.04.1
ubuntupatch availablevia ubuntu_usn
Product: simpleeval (xenial)Fixed in: 0.8.7-1ubuntu0.1~esm1

Vendor Advisories (2)

ubuntuUSN-8301-1

SimpleEval vulnerability

May 25, 2026
pipGHSA-44vg-5wv2-h2hghigh

SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox

Mar 13, 2026

References

access.redhat.com / errata/RHSA-2026:10184
access.redhat.com / errata/RHSA-2026:37275
access.redhat.com / security/cve/CVE-2026-32640
bugzilla.redhat.com / show_bug.cgi
security.access.redhat.com / data/csaf/v2/vex/2026/cve-2026-32640.json
lists.debian.org / debian-lts-announce/2026/04/msg00023.html
github.com / danthedeckie/simpleeval/security/advisories/GHSA-44vg-5wv2-h2hg
MitigationVendor Advisory