https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 12:03:18 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-344116 EUVD-2026-344116 https://cve.radiocsirt.org/vuln/euvd-2026-344116 https://cve.radiocsirt.org/vuln/fkie_cve-2026-67195 <p>Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python&#39;s eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpreter&#39;s loaded class list to reach subprocess.Popen via a TableValidateExprReq or TableMakeViewReq protobuf message, achieving arbitrary command execution in the Perspective host process.</p> <p>Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python&#39;s eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpreter&#39;s loaded class list to reach subprocess.Popen via a TableValidateExprReq or TableMakeViewReq protobuf message, achieving arbitrary command execution in the Perspective host process.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-67195 https://cve.radiocsirt.org/vuln/ghsa-3jqr-28gj-8vq4 <p>Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python&#39;s eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpreter&#39;s loaded class list to reach subprocess.Popen via a TableValidateExprReq or TableMakeViewReq protobuf message, achieving arbitrary command execution in the Perspective host process.</p> <p>Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python&#39;s eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpreter&#39;s loaded class list to reach subprocess.Popen via a TableValidateExprReq or TableMakeViewReq protobuf message, achieving arbitrary command execution in the Perspective host process.</p> https://cve.radiocsirt.org/vuln/ghsa-3jqr-28gj-8vq4