PatchSiren cyber security CVE debrief

CVE-2026-32640 danthedeckie CVE debrief

The SimpleEval library, used for adding evaluatable expressions to Python projects, has a critical vulnerability (CVE-2026-32640) that allows objects, including modules, to leak dangerous modules through direct access inside the sandbox. This issue, fixed in version 1.0.5, enables attackers to access dangerous functions or modules by passing them as callbacks to safe functions. The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity. The CVE was published on March 16, 2026, and last modified on June 30, 2026.

Vendor: danthedeckie
Product: simpleeval
CVSS: HIGH 8.7
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-03-16
Original CVE updated: 2026-07-15
Advisory published: 2026-03-16
Advisory updated: 2026-07-15

Who should care

Developers and security teams using the SimpleEval library in their Python projects should be aware of this vulnerability. Given its high severity and potential for exploitation, immediate attention is required to ensure that the library is updated to version 1.0.5 or later. This is particularly crucial for applications that utilize evaluatable expressions and may be exposed to malicious inputs.

Technical summary

CVE-2026-32640 is a vulnerability in the SimpleEval library that allows for the leakage of dangerous modules and execution of disallowed functions. The issue arises from the library's sandboxing mechanism, which can be bypassed by passing objects with modules or disallowed attributes. Attackers can exploit this by providing crafted inputs that lead to the execution of malicious code. The vulnerability is addressed in SimpleEval version 1.0.5. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

High priority should be given to updating the SimpleEval library to version 1.0.5 or later. In the interim, defenders should review their codebase for any usage of SimpleEval that could be exploited and consider implementing additional security measures, such as input validation and sandboxing.

Recommended defensive actions

Update SimpleEval to version 1.0.5 or later
Review and restrict input to SimpleEval expressions
Implement additional sandboxing and security measures for evaluatable expressions
Monitor for and respond to potential exploitation attempts
Conduct a thorough inventory of systems and applications using SimpleEval

Evidence notes

The CVE-2026-32640 vulnerability is confirmed by multiple sources, including the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) list. The vulnerability is addressed in SimpleEval version 1.0.5, which fixes the issue of dangerous module leaks and execution of disallowed functions. The CVSS score of 8.7 indicates a high severity vulnerability that requires immediate attention.

Sources and references

Verified primary and authoritative sources

CVE-2026-32640 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-32640

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-32640 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32640

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://github.com/danthedeckie/simpleeval/security/advisories/GHSA-44vg-5wv2-h2hg

[email protected] - Mitigation, Vendor Advisory
Source reference
Unverified legacy reference

URL: https://lists.debian.org/debian-lts-announce/2026/04/msg00023.html

af854a3a-2127-422b-91ae-364da2661108
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:10184

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/security/cve/CVE-2026-32640

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32640.json

0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.