CVE-2026-102734

Executive Summary

CVE-2026-102734 is a sandbox escape vulnerability in asteval, a Python library designed for restricted expression evaluation, affecting versions prior to 1.0.9. When the default Interpreter is configured with numpy enabled, an attacker-controlled expression can leverage exposed ctypes type objects and unfiltered attribute assignment to read and write arbitrary process memory, achieving code execution and full sandbox escape. Organizations using asteval to evaluate untrusted expressions — particularly in plugin systems, scientific workflow tools, or AI/LLM agent frameworks — face process compromise, secret disclosure, and denial of service.

Technical Analysis

asteval is a Python library that evaluates user-supplied expressions under a restricted execution model. It relies on asteval/astutils.py for attribute access control and interpreter utilities. The vulnerability arises from two distinct weaknesses that combine into a full sandbox escape:

1. Incomplete ctypes blocking (safe_getattr): safe_getattr is intended to prevent access to the ctypes module. However, it blocks the module name but not ctypes type objects that are reachable through the interpreter's environment when numpy is enabled. Once a ctypes type is reachable, the attacker can access ctypes functionality — notably from_address — which constructs a Python object from a raw memory address, allowing arbitrary memory read.

2. Unfiltered attribute assignment (setattr): Attribute assignments in evaluated expressions use the built-in setattr rather than safe_setattr. This bypasses the intended write restrictions, allowing an attacker to mutate object attributes and, combined with ctypes pointers, write to arbitrary memory.

The attack chain within a single expression is: (a) derive a raw address using id on a target Python object, (b) instantiate a ctypes object from that address via from_address, and (c) perform a write through unfiltered attribute assignment. Critically, the vulnerability does not require a separate memory corruption primitive in a compiled language — Python's own ctypes abstraction provides both read and write access to process memory. The result is read or corruption of arbitrary process memory, sandbox escape, arbitrary code execution, secret disclosure, and host process crash. The fix in version 1.0.9 presumably hardens safe_getattr to block reachable ctypes type objects and replaces setattr with safe_setattr for attribute assignments.

The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5) indicates that exploitation requires local access with user interaction, no privileges, and has high availability impact, but no confidentiality or integrity impact per the vector — an interesting scoring choice given the description explicitly mentions secret disclosure. This discrepancy should be noted; the vector appears to underweight the read/write memory access described.

Exploitation Scenarios

No public PoC is available. The attack chain below is inferred strictly from the NVD description and vulnerability class.

1. Reconnaissance / target identification: The attacker identifies an application that evaluates untrusted expressions with asteval configured with numpy enabled (the default Interpreter with numpy). This is common in scientific computing pipelines, notebooks, plugin systems, and agent frameworks that allow end users to submit expressions.

2. Triggering the flaw class: The attacker submits an expression that references a reachable ctypes type object from within the interpreter namespace (the description states safe_getattr blocks the ctypes module but not reachable ctypes type objects). This bypasses the intended module-level restriction.

3. Payload / execution at vulnerability-class level: Using the reachable ctypes type, the attacker calls from_address to obtain arbitrary memory read access. The attacker derives a target address with id, then reads memory through the ctypes object. To write, the attacker performs an attribute assignment that goes through the unfiltered setattr path rather than safe_setattr, mutating object state or writing to the derived address.

4. Post-exploitation impact: The attacker can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets (e.g., API keys, tokens, credentials present in the process), or crash the host process. Because the vector requires user interaction (UI:R), initial delivery typically requires inducing an operator or service to evaluate the malicious expression.

Impact Assessment

CVSS 3.1 score 5.5 (Medium): AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. Exploitation requires local access to the evaluation context and user interaction, with no privileges required. Per the vector, confidentiality and integrity impacts are None while availability impact is High — but the NVD description states arbitrary memory read/write, code execution, and secret disclosure, which implies significant confidentiality and integrity impact. Security teams should treat the practical impact as higher than the vector suggests. Blast radius: any host process embedding asteval with numpy enabled and evaluating untrusted input. This includes CI/CD runners executing user-submitted expressions, data-science platforms, and LLM agent toolchains where generated expressions are evaluated. Successful exploitation yields full process compromise, not just sandbox escape.

Detection Guidance

Sigma Rule

title: Possible asteval Sandbox Escape via ctypes and from_address (CVE-2026-102734)
id: 7c9f2a41-1e83-4d5b-9a6c-asteval0001
status: experimental
description: Detects Python processes referencing asteval alongside ctypes and from_address in the same execution context, indicating potential CVE-2026-102734 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102734
author: Valters IT Threat Intelligence
logsource:
  category: process_creation
  product: linux
detection:
  selection_python:
    Image|endswith:
      - '/python'
      - '/python3'
  selection_asteval:
    CommandLine|contains: 'asteval'
  selection_ctypes:
    CommandLine|contains:
      - 'ctypes'
      - 'from_address'
  condition: selection_python and selection_asteval and selection_ctypes
falsepositives:
  - Legitimate development and debugging activity
  - Security research and testing
level: medium
tags:
  - attack.t1203
  - cve.2026.102734

YARA Rule

rule CVE_2026_102734_asteval_ctypes_escape
{
    meta:
        description = "Detects asteval sandbox escape payload referencing ctypes from_address"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102734"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $asteval = "asteval" ascii wide nocase
        $from_address = "from_address" ascii wide
        $ctypes = "ctypes" ascii wide
        $id_call = "id(" ascii wide
        $setattr = "setattr" ascii wide
    condition:
        2 of ($from_address, $ctypes, $id_call, $setattr) and $asteval
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102734 asteval sandbox escape attempt via ctypes from_address"; flow:to_server,established; http.request_body; content:"ctypes"; nocase; http.request_body; content:"from_address"; nocase; http.request_body; content:"id("; nocase; reference:cve,2026-102734; classtype:attempted-admin; sid:2026102734; rev:1;)

Elastic Detection

process where process.name : ("python" or "python3") and
  process.command_line : "*asteval*" and
  process.command_line : ("*ctypes*" or "*from_address*")

Splunk SPL Query

index=endpoint (process_name=python OR process_name=python3)
| where match(command_line, "(?i)asteval") AND match(command_line, "(?i)(ctypes|from_address)")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, command_line
| where count > 0

Wazuh OSSEC Rule

<group name="asteval,cve-2026-102734,">
  <rule id="100734" level="10">
    <if_sid>100000</if_sid>
    <field name="command_line">asteval</field>
    <field name="command_line">ctypes|from_address</field>
    <description>CVE-2026-102734: Possible asteval sandbox escape via ctypes from_address</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Disable numpy integration in asteval where expression evaluation of untrusted input is required; the vulnerability specifically involves the default Interpreter with numpy enabled exposing a ctypes type.
   • Do not evaluate untrusted or user-supplied expressions with asteval. Apply strict input allowlisting and reject expressions referencing ctypes, from_address, or dynamic attribute mutation.
   • Restrict network and local access to services that evaluate expressions, and run such services in a low-privilege, isolated container with a read-only filesystem and no access to secrets.
   • Monitor expression submissions for suspicious tokens (ctypes, from_address, id() via application-level logging.

2. Patch/upgrade steps:

   • Upgrade asteval to version 1.0.9 or later, which contains the fix. Note: no vendor advisory or patch source is currently tracked; validate the release artifact and checksum from the upstream project before deployment.
   • After upgrading, re-verify that safe_getattr blocks reachable ctypes type objects and that attribute assignments use safe_setattr.

3. Long-term hardening:

   • Treat all expression evaluators as untrusted code execution surfaces; apply OS-level sandboxing (seccomp, gVisor, separate user namespaces) rather than relying solely on library-level sandboxing.
   • Rotate any secrets that may have been exposed in processes previously running vulnerable asteval.
   • Integrate dependency scanning to flag asteval versions < 1.0.9 in SBOMs.

References

• NVD — CVE-2026-102734: https://nvd.nist.gov/vuln/detail/CVE-2026-102734
• asteval project (upstream source and release 1.0.9): https://github.com/newville/asteval
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• CWE-693 — Protection Mechanism Failure: https://cwe.mitre.org/data/definitions/693.html
• CISA KEV Catalog: not listed (no known exploited vulnerability status as of this report)

No public PoC or exploit code is available, and no threat actor campaign or in-the-wild exploitation has been reported for CVE-2026-102734.