CVE-2026-32640
Critical
Description
SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.
SeverityCritical
CVSS9.8
Exploit probability—
ProductDanthedeckie Simpleeval
PublishedMar 16, 2026
First seenMar 16, 2026
Weakness typeCWE-915CWE-915CWE-94Code injection
How to fix
Update
- danthedeckie simpleeval1.0.5 or later
- simpleeval1.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| danthedeckie simpleeval | v < 1.0.5 | 1.0.5 |
| simpleevalPyPI | v < 1.0.5 | 1.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.