python3-simpleeval: Fix CVE-2026-32640

Manually backport the three upstream security fixes for CVE-2026-32640 to the Scarthgap simpleeval 0.9.13 recipe [1][2][3]. Include the required unhashable-container correction [4], which prevents the recursive security checks from raising TypeError on legitimate list and tuple values. Harden the recursive callback-argument validation to inspect sets, frozensets, and dictionary keys, and safely handle cyclic containers. Add regression coverage for each of these cases. Do not include the separate generator/coroutine hardening or the optional performance follow-up. Omit the new ModuleWrapper API so this stable-branch fix adds no unrelated public feature. [1] https://github.com/danthedeckie/simpleeval/commit/9cb4a7b99498 [2] https://github.com/danthedeckie/simpleeval/commit/1654cbf02193 [3] https://github.com/danthedeckie/simpleeval/commit/cffa9f68cee5 [4] https://github.com/danthedeckie/simpleeval/commit/d1e4569db678 Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-22 11:00:49 +00:00 · 2026-09-01 06:57:22 +05:30
parent 97131550a8
commit 6752204aad
5 changed files with 824 additions and 1 deletions
@@ -0,0 +1,55 @@
+From 1f59b001d140f3c35b813150de48509bcc61713d Mon Sep 17 00:00:00 2001
+From: Daniel Fairhead <daniel@dev.ngo>
+Date: Thu, 12 Mar 2026 09:33:17 +0000
+Subject: [PATCH 1/4] Add a few additional DISALLOW_FUNCTIONS
+
+CVE: CVE-2026-32640
+Upstream-Status: Backport [https://github.com/danthedeckie/simpleeval/commit/9cb4a7b99498c173263bd90f77bc185e160fb6b8]
+
+Backport Changes:
+- Add exec while expanding DISALLOW_FUNCTIONS because simpleeval 0.9.13 does not contain the earlier generator-hardening change that added it.
+
+(cherry picked from commit 9cb4a7b99498c173263bd90f77bc185e160fb6b8)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ simpleeval.py | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/simpleeval.py b/simpleeval.py
+index f6a3ed6..91ed582 100644
+--- a/simpleeval.py
+++ b/simpleeval.py
+@@ -98,6 +98,7 @@ well:
+ 
+ import ast
+ import operator as op
+import os
+ import sys
+ import warnings
+ from random import random
+@@ -123,7 +124,21 @@ DISALLOW_METHODS = ["format", "format_map", "mro"]
+ # their functionality is required, then please wrap them up in a safe container.  And think
+ # very hard about it first.  And don't say I didn't warn you.
+ # builtins is a dict in python >3.6 but a module before
+-DISALLOW_FUNCTIONS = {type, isinstance, eval, getattr, setattr, repr, compile, open}
+DISALLOW_FUNCTIONS = {
+    type,
+    isinstance,
+    eval,
+    getattr,
+    setattr,
+    repr,
+    compile,
+    open,
+    exec,
+    globals,
+    locals,
+    os.popen,
+    os.system,
+}
+ if hasattr(__builtins__, "help") or (
+     hasattr(__builtins__, "__contains__") and "help" in __builtins__  # type: ignore
+ ):
+-- 
+2.35.6
+