CVE-2026-34444

VULNERABILITY OVERVIEW CVE-2026-34444 affects Lupa version 2.6 and earlier, a Python library that integrates Lua and LuaJIT2 runtimes into CPython. The vulnerability stems from inconsistent application of the attribute_filter security control when attributes are accessed through built-in functions such as getattr and setattr, enabling attackers to circumvent intended access restrictions. SEVERITY ASSESSMENT The vulnerability permits arbitrary code execution through attribute filter bypass, representing a critical impact potential. While specific CVSS vector details are unavailable, the EPSS score of 0.00028 and FAUCET Risk Score of 49.0/100 indicate moderate community concern. The attack requires local access and understanding of the Lupa library's implementation, suggesting moderate attack complexity rather than trivial exploitation. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as the vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat tracking lists. However, the availability of descriptive technical information regarding the attribute_filter bypass mechanism may facilitate exploit development by motivated threat actors familiar with Python and Lua integration mechanisms.