CVE-2026-67195

Name of the Vulnerable Software and Affected Versions Perspective version 5.0.0

Description An issue exists in the PolarsVirtualServer backend where unauthenticated attackers can execute arbitrary operating system commands. This occurs because client-supplied input is passed directly to the Python eval() function with only builtins ={} cleared. Attackers can use Python object attribute traversal through the interpreter's loaded class list to reach subprocess.Popen via TableValidateExprReq or TableMakeViewReq protobuf messages, resulting in command execution within the Perspective host process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.