CVE-2026-55244

Name of the Vulnerable Software and Affected Versions asteval versions prior to 1.0.9

Description An attacker can trigger a Denial of Service (DoS) by supplying specific expressions to the asteval.Interpreter.eval() function. The issue occurs because the FROM PY list in asteval/astutils.py exposes classes that inherit from BaseException but not from Exception, specifically SystemExit, KeyboardInterrupt, GeneratorExit, and BaseException.

Since the exception handlers in the run() and eval() functions only catch Exception, these specific subclasses bypass the safety net and propagate directly to the calling application. This allows an attacker to terminate the process, disrupt signal handlers, or interfere with generator cleanup.

Technical details include:

Recommendations Update to version 1.0.9 or later. As a temporary mitigation, remove BaseException, GeneratorExit, KeyboardInterrupt, and SystemExit from the FROM PY list in asteval/astutils.py to prevent these classes from being accessible within the sandbox.