SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Danthedeckie
  • Simpleeval

Configuration 1 [-]

cpe:2.3:a:danthedeckie:simpleeval:*:*:*:*:*:python:*:*

No data.

References
Link Providers
https://github.com/danthedeckie/simpleeval/security/advisories/GHSA-44vg-5wv2-h2hg cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-32640 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-32640 cve-icon
History

Wed, 18 Mar 2026 18:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:danthedeckie:simpleeval:*:*:*:*:*:python:*:*
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Tue, 17 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

threat_severity

Important

Mon, 16 Mar 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 16 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Danthedeckie
Danthedeckie simpleeval
Vendors & Products Danthedeckie
Danthedeckie simpleeval

Fri, 13 Mar 2026 21:30:00 +0000

Type Values Removed Values Added
Description SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.
Title (SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.
Weaknesses CWE-915
CWE-94
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-03-13T21:03:53.435Z

Updated: 2026-03-16T16:48:21.852Z

Reserved: 2026-03-12T15:29:36.560Z

Link: CVE-2026-32640

cve-icon Vulnrichment

Updated: 2026-03-16T16:48:18.796Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-16T14:19:40.930

Modified: 2026-03-18T18:26:49.927

Link: CVE-2026-32640

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-13T21:03:53Z

Links: CVE-2026-32640 - Bugzilla