CVE-2026-32640 (SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.
Attackers can execute arbitrary code by leaking dangerous modules through object attributes in the SimpleEval sandbox.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32640?
CVE-2026-32640 is a high-severity code injection vulnerability in danthedeckie simpleeval, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.
Which versions are affected by CVE-2026-32640?
3 open source packages ship an affected version, including simpleeval. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
simpleeval PyPI | All versions | 1.0.5 |
simpleeval PyPI | All versions | 1.0.5 |
simpleeval PyPI | All versions | 1.0.5 |
Linux distribution packages (2)
python-simpleeval openSUSE:Leap 16.0 | All versions | 0.9.13-bp160.2.1 |
python-simpleeval openSUSE:Tumbleweed | All versions | 1.0.5-1.1 |
Products include Danthedeckie Simpleeval.
How do I fix CVE-2026-32640?
Upgrade simpleeval to 1.0.5 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-32640 being exploited?
There is no known exploitation of CVE-2026-32640 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-32640, GHSA-44vg-5wv2-h2hg, PYSEC-2026-132, UBUNTU-CVE-2026-32640, USN-8301-1, openSUSE-SU-2026:10373-1 and 1 more.