From 1f59b001d140f3c35b813150de48509bcc61713d Mon Sep 17 00:00:00 2001 From: Daniel Fairhead Date: Thu, 12 Mar 2026 09:33:17 +0000 Subject: [PATCH 1/4] Add a few additional DISALLOW_FUNCTIONS CVE: CVE-2026-32640 Upstream-Status: Backport [https://github.com/danthedeckie/simpleeval/commit/9cb4a7b99498c173263bd90f77bc185e160fb6b8] Backport Changes: - Add exec while expanding DISALLOW_FUNCTIONS because simpleeval 0.9.13 does not contain the earlier generator-hardening change that added it. (cherry picked from commit 9cb4a7b99498c173263bd90f77bc185e160fb6b8) Signed-off-by: Hetvi Thakar --- simpleeval.py | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/simpleeval.py b/simpleeval.py index f6a3ed6..91ed582 100644 --- a/simpleeval.py +++ b/simpleeval.py @@ -98,6 +98,7 @@ well: import ast import operator as op +import os import sys import warnings from random import random @@ -123,7 +124,21 @@ DISALLOW_METHODS = ["format", "format_map", "mro"] # their functionality is required, then please wrap them up in a safe container. And think # very hard about it first. And don't say I didn't warn you. # builtins is a dict in python >3.6 but a module before -DISALLOW_FUNCTIONS = {type, isinstance, eval, getattr, setattr, repr, compile, open} +DISALLOW_FUNCTIONS = { + type, + isinstance, + eval, + getattr, + setattr, + repr, + compile, + open, + exec, + globals, + locals, + os.popen, + os.system, +} if hasattr(__builtins__, "help") or ( hasattr(__builtins__, "__contains__") and "help" in __builtins__ # type: ignore ): -- 2.35.6