Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-32640 Details

Description

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: redhat-SADPCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://access.redhat.com/errata/RHSA-2026:10184	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:37275	redhat-SADP
https://access.redhat.com/security/cve/CVE-2026-32640	redhat-SADP
https://bugzilla.redhat.com/show_bug.cgi?id=2447529	redhat-SADP
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32640.json	redhat-SADP
https://lists.debian.org/debian-lts-announce/2026/04/msg00023.html	CVE
https://github.com/danthedeckie/simpleeval/security/advisories/GHSA-44vg-5wv2-h2hg	[email protected]	MitigationVendor Advisory

see all 7 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-915	Improperly Controlled Modification of Dynamically-Determined Object Attributes	redhat-SADP
CWE-915	Improperly Controlled Modification of Dynamically-Determined Object Attributes	[email protected]
CWE-94	Improper Control of Generation of Code ('Code Injection')	[email protected]

Affected Products

Product	Versions
danthedeckie simpleeval	< 1.0.5
CPE cpe:2.3:a:danthedeckie:simpleeval::::::python::* Remediation No remediation found in references.

Change History

8 change records found show changes

Date	Action	Recorded By
Jul 15, 2026	CVE Modified	redhat-SADP
Jul 10, 2026	CVE Modified	redhat-SADP
Jun 30, 2026	CVE Modified	redhat-SADP
Jun 17, 2026	CVE Modified	CISA-ADP
Jun 17, 2026	CVE Modified	[email protected]
Apr 21, 2026	CVE Modified	CVE
Mar 18, 2026	Initial Analysis	[email protected]
Mar 16, 2026	New CVE Received	[email protected]