CVE-2026-32640 identifies a critical sandbox escape vulnerability in the SimpleEval Python library, affecting versions prior to 1.0.5. This flaw allows dangerous modules or objects to be accessed within the sandbox, either through direct attribute access on passed-in objects or via callbacks to safe functions. Rated 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it permits remote, unauthenticated attackers to achieve full confidentiality, integrity, and availability compromise. Despite its severity, there is currently no evidence of active exploitation, nor are public exploit codes available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, and it is not listed on the CISA KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.0.5CPE matchmatch criteria | cpe:2.3:a:danthedeckie:simpleeval:*:*:*:*:*:python:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.