CVE catalog

CVE-2026-32640

SimpleEval vulnerability

Severity: Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Mar 13, 2026, 9:03:53 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.53% · Oct 25, 2026

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	simpleeval	sid	`1.0.8-1`	fixed
Debian	simpleeval	forky	`1.0.7-1`	fixed
Debian	simpleeval	trixie	`1.0.3-1+deb13u1`	fixed
Debian	simpleeval	trixie-security	`1.0.3-1+deb13u1`	fixed
Debian	simpleeval	bookworm	`0.9.12-1+deb12u1`	fixed
Debian	simpleeval	bookworm-security	`0.9.12-1+deb12u1`	fixed
Pip	simpleeval	Not reported	`1.0.5`	fixed
Ubuntu	simpleeval	noble	Not reported	vulnerable
Ubuntu	simpleeval	noble	`0.9.12-1+deb12u1build0.24.04.1`	fixed
Ubuntu	python3-simpleeval	noble	`0.9.12-1+deb12u1build0.24.04.1`	fixed
Ubuntu	simpleeval	pro	`0.9.10-1`	vulnerable
Ubuntu	simpleeval	pro	`0.9.11-1`	vulnerable
Ubuntu	simpleeval	pro	`0.9.11-1ubuntu0.1~esm1`	fixed
Ubuntu	simpleeval	24.04	`0.9.12-1`	vulnerable
Ubuntu	simpleeval	24.04	`0.9.12-1+deb12u1build0.24.04.1`	fixed
Ubuntu	simpleeval	25.10	`1.0.3-1`	vulnerable
Ubuntu	simpleeval	25.10	`1.0.3-1+deb13u1build0.25.10.1`	fixed
Ubuntu	simpleeval	26.04	`1.0.3-1`	vulnerable
Ubuntu	simpleeval	26.04	`1.0.3-1build1`	vulnerable
Ubuntu	simpleeval	26.04	`1.0.3-1+deb13u1build0.26.04.1`	fixed
Opensuse	python-simpleeval	leap 16.0	`0.9.13-bp160.2.1`	fixed
Opensuse	python-simpleeval	tumbleweed	`1.0.5-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	simpleeval	source	sid	`1.0.7-1`	not yet assigned	Not reported	[1130875]
Debian	simpleeval	source	forky	`1.0.7-1`	not yet assigned	Not reported	[1130875]
Debian	simpleeval	source	trixie	`1.0.3-1+deb13u1`	not yet assigned	Not reported	[1130875]
Debian	simpleeval	source	bookworm	`0.9.12-1+deb12u1`	not yet assigned	Not reported	[1130875]
Pip	simpleeval	pip	Not reported	`1.0.5`	Not reported	Not reported	Not reported
Ubuntu	simpleeval	deb	noble	`0.9.12-1+deb12u1build0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	python3-simpleeval	deb	noble	`0.9.12-1+deb12u1build0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	simpleeval	deb	pro	`0.9.11-1ubuntu0.1~esm1`	Not reported	USN-8301-1	Not reported
Ubuntu	simpleeval	deb	24.04	`0.9.12-1+deb12u1build0.24.04.1`	Not reported	USN-8301-1	Not reported
Ubuntu	simpleeval	deb	25.10	`1.0.3-1+deb13u1build0.25.10.1`	Not reported	USN-8301-1	Not reported
Ubuntu	simpleeval	deb	26.04	`1.0.3-1+deb13u1build0.26.04.1`	Not reported	USN-8301-1	Not reported
Opensuse	python-simpleeval	rpm	leap 16.0	`0.9.13-bp160.2.1`	Not reported	OPENSUSE-SU-2026:20393-1	Not reported
Opensuse	python-simpleeval	rpm	tumbleweed	`1.0.5-1.1`	Not reported	OPENSUSE-SU-2026:10373-1	Not reported

[Debian bug #1130875]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[python313-simpleeval]Unknown
Source package: [python-simpleeval]
Details (1)
- 1.0.7-1.4 · noarch · tumbleweed
  Unknown · Fixed: 1.0.5-1.1
  Version impact unknown
  usn · python-simpleeval · opensuse · tumbleweed
[python314-simpleeval]Unknown
Source package: [python-simpleeval]
Details (1)
- 1.0.7-1.4 · noarch · tumbleweed
  Unknown · Fixed: 1.0.5-1.1
  Version impact unknown
  usn · python-simpleeval · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[python3-simpleeval]Fixed
Source package: [simpleeval]
Details (4)
- 0.9.12-1+deb12u1 · all · bookworm
  Fixed · Fixed: 0.9.12-1+deb12u1
  usn · simpleeval · debian · bookworm; usn · simpleeval · debian · 12
- 0.9.12-1+deb12u1 · all · bookworm
  Fixed · Fixed: 0.9.12-1+deb12u1
  usn · simpleeval · debian · bookworm; usn · simpleeval · debian · 12
- 0.9.12-1+deb12u1 · all · bookworm-security
  Fixed · Fixed: 0.9.12-1+deb12u1
  usn · simpleeval · debian · bookworm; usn · simpleeval · debian · 12
- 0.9.12-1+deb12u1 · all · bookworm-security
  Fixed · Fixed: 0.9.12-1+deb12u1
  usn · simpleeval · debian · bookworm; usn · simpleeval · debian · 12

[Debian 13 (Trixie)]

[python3-simpleeval]Fixed
Source package: [simpleeval]
Details (4)
- 1.0.3-1+deb13u1 · all · trixie
  Fixed · Fixed: 1.0.3-1+deb13u1
  usn · simpleeval · debian · 13
- 1.0.3-1+deb13u1 · all · trixie
  Fixed · Fixed: 1.0.3-1+deb13u1
  usn · simpleeval · debian · 13
- 1.0.3-1+deb13u1 · all · trixie-security
  Fixed · Fixed: 1.0.3-1+deb13u1
  usn · simpleeval · debian · 13
- 1.0.3-1+deb13u1 · all · trixie-security
  Fixed · Fixed: 1.0.3-1+deb13u1
  usn · simpleeval · debian · 13

Observed: Oct 27, 2026, 9:30:00 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]