Affected: Homebrew: omnara

### Summary The `attribute_filter` in the Lupa library is intended to restrict access to sensitive Python attributes when exposing objects to Lua.

However, the filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.

### Details The `attribute_filter` is meant to block access to attributes such as `__class__`, `__mro__`, and similar internal properties.

In practice, it only applies to direct attribute access: - `obj.attr` → filtered - `getattr(obj, "attr")` → not filtered Because of this inconsistency, it’s possible to bypass the filter entirely, if access to the Python builtins is granted to Lua code.

An attacker can use getattr to- - Access `__class__` - Walk the `__mro__` chain - Call `__subclasses__()` - Iterate over available classes - Find a function that exposes `__globals__` - Retrieve something like `os.system`

At that point, arbitrary command execution becomes straightforward.

This effectively breaks the security boundary that `attribute_filter` is expected to enforce.

### PoC The following example shows how the filter can be bypassed to execute `os.system`:' ``` import lupa from lupa import LuaRuntime

def protected_attribute_filter(obj, attr_name, is_setting): if isinstance(attr_name, str) and attr_name.startswith('_'): raise AttributeError(f"Access to '{attr_name}' is forbidde…

Affected: scoder lupa, Red Hat Satellite 6.18, Red Hat OpenShift AI (RHOAI)

Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.

Affected: PyPI: lupa

### Summary The `attribute_filter` in the Lupa library is intended to restrict access to sensitive Python attributes when exposing objects to Lua.

However, the filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.

### Details The `attribute_filter` is meant to block access to attributes such as `__class__`, `__mro__`, and similar internal properties.

In practice, it only applies to direct attribute access: - `obj.attr` → filtered - `getattr(obj, "attr")` → not filtered Because of this inconsistency, it’s possible to bypass the filter entirely, if access to the Python builtins is granted to Lua code.

An attacker can use getattr to- - Access `__class__` - Walk the `__mro__` chain - Call `__subclasses__()` - Iterate over available classes - Find a function that exposes `__globals__` - Retrieve something like `os.system`

At that point, arbitrary command execution becomes straightforward.

This effectively breaks the security boundary that `attribute_filter` is expected to enforce.

### PoC The following example shows how the filter can be bypassed to execute `os.system`:' ``` import lupa from lupa import LuaRuntime

def protected_attribute_filter(obj, attr_name, is_setting): if isinstance(attr_name, str) and attr_name.startswith('_'): raise AttributeError(f"Access to '{attr_name}' is forbidde…