asteval@0.9.25 vulnerabilities

Safe, minimalistic evaluator of python expression using ast module

latest version

1.0.6

latest non vulnerable version

1.0.6

first published

13 years ago

latest version published

3 months ago

licenses detected

MIT
[0.9.11,)

View asteval package health on Snyk Advisor (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the asteval package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Exposed Dangerous Method or Function asteval is a Safe, minimalistic evaluator of python expression using ast module Affected versions of this package are vulnerable to Exposed Dangerous Method or Function through the `on_formattedvalue` function. An attacker can manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)` to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. How to fix Exposed Dangerous Method or Function? Upgrade `asteval` to version 1.0.6 or higher.	[,1.0.6)
H Exposed Dangerous Method or Function asteval is a Safe, minimalistic evaluator of python expression using ast module Affected versions of this package are vulnerable to Exposed Dangerous Method or Function stems from the library's attribute access verification method, specifically within the `on_attribute` node handler. The handler is intended to block access to sensitive Python dunder methods by checking against a list of unsafe attributes and attribute patterns. However, due to a flaw in the implementation, an attacker can manipulate the attribute access mechanism by altering the attribute name during runtime, thereby bypassing the safety checks and executing arbitrary code. How to fix Exposed Dangerous Method or Function? Upgrade `asteval` to version 1.0.6 or higher.	[,1.0.6)

Exposed Dangerous Method or Function

asteval is a Safe, minimalistic evaluator of python expression using ast module

Affected versions of this package are vulnerable to Exposed Dangerous Method or Function through the on_formattedvalue function. An attacker can manipulate the value of the string used in the dangerous call fmt.format(__fstring__=val) to access protected attributes by intentionally triggering an AttributeError exception. The attacker can then catch the exception and use its obj attribute to gain arbitrary access to sensitive or protected object properties.

How to fix Exposed Dangerous Method or Function?

Upgrade asteval to version 1.0.6 or higher.

[,1.0.6)

Exposed Dangerous Method or Function

asteval is a Safe, minimalistic evaluator of python expression using ast module

Affected versions of this package are vulnerable to Exposed Dangerous Method or Function stems from the library's attribute access verification method, specifically within the on_attribute node handler. The handler is intended to block access to sensitive Python dunder methods by checking against a list of unsafe attributes and attribute patterns. However, due to a flaw in the implementation, an attacker can manipulate the attribute access mechanism by altering the attribute name during runtime, thereby bypassing the safety checks and executing arbitrary code.

How to fix Exposed Dangerous Method or Function?

Upgrade asteval to version 1.0.6 or higher.

[,1.0.6)

Go back to all versions of this package