CVE-2026-32640 is a critical sandbox escape in SimpleEval, the Python expression evaluation library, scored CVSS 9.8. Objects and modules you pass in can expose dangerous modules through their attributes. Versions before 1.0.5 are affected, so upgrade to 1.0.5 and avoid passing whole modules into the evaluator.
What's affected
The GitHub advisory lists the pip package simpleeval, versions below 1.0.5, with 1.0.5 as the patched version.
The exposure depends on what you hand to the evaluator. The advisory says the problem appears when the objects you pass in as names have modules or other disallowed objects reachable as attributes. It also says dangerous functions or modules could be reached by passing them as callbacks to other safe functions.
The advisory gives examples of modules where a chain of ordinary attributes reaches the os or sys modules: os.path, pathlib, shutil, glob, statistics, numpy and urllib.parse. Debian 11 users have a backported fix, listed in Debian LTS advisory DLA-4543-1 as version 0.9.10-1+deb11u1.
How to check if you're exposed
Check the installed version:
pip show simpleeval
On Debian 11, check the package version:
dpkg -l python3-simpleeval
Then read your own code. Search for every call that builds a SimpleEval or EvalWithCompoundTypes object and look at the names and functions you give it:
grep -rnE "SimpleEval|simple_eval|EvalWithCompoundTypes" .
If any value in names is a module, a class instance with module attributes, or a function that accepts callbacks, you are in the risky pattern. If you only pass plain numbers, strings and your own small functions, the exposure is lower, but upgrade anyway.
What to do now
- Upgrade simpleeval to 1.0.5 or later, and rebuild any container image that pins an older version.
- On Debian 11, apply the DLA-4543-1 update.
- Stop passing modules or objects that carry module attributes. Pass only the specific functions and values you need.
- If you must expose a module, wrap it with the ModuleWrapper that version 1.0.5 provides.
- Treat any expression text from users as untrusted, and log or limit what it can reach.
- Check transitive use. Other packages may depend on simpleeval, so scan your lock files too.
Plan this fix in two steps, the upgrade and the cleanup.
The upgrade is simple, but dependency trees hide copies. Search your lock files and container images for simpleeval, not only your direct requirements. Libraries that offer user defined formulas, rules or filters sometimes pull it in.
The cleanup is about the objects you pass in. Make a list of every name, function and class instance you give an evaluator. For each one, ask what it can reach through attributes. A bare function or a number is fine. A module, a client object or anything that holds a reference to one is not.
With 1.0.5 the maintainers provide a wrapper for items that would otherwise expose dangerous attributes. Where you need to expose part of a module, expose small functions that do exactly one job, and test that expressions cannot walk from them to anything else.
Why it matters
The weaknesses are CWE-94, code injection, and CWE-915, improperly controlled modification of dynamically determined object attributes. A sandboxed evaluator is only as safe as the objects inside it. If an allowed object has an attribute that points to os, a chain of harmless looking lookups reaches the operating system.
This is a common failure of allowlist sandboxes in dynamic languages. The language makes it easy to walk from one object to another. The library can block names that start with an underscore, but it cannot know what every object you pass in links to.
Expression evaluators often appear in rules engines, spreadsheets, workflow tools and configuration systems, where the expression comes from a user or an admin. That is why this library shows up deep in dependency trees. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does passing only plain data keep me safe?
It lowers the exposure a lot, because the dangerous path needs an object with reachable module attributes. Upgrading is still the advised fix.
What does the ModuleWrapper do?
Version 1.0.5 provides it as a way to wrap items that would otherwise expose dangerous attributes. Check the project documentation for its exact use.
Sources
Last reviewed: 19 October 2026.
