CVE-2026-67195

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpreter's loaded class list to reach subprocess.Popen via a TableValidateExprReq or TableMakeViewReq protobuf message, achieving arbitrary command execution in the Perspective host process.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://christbowel.com/blog/perspective-5-0-0-five-cves/
https://www.vulncheck.com/advisories/perspective-rce-via-eval-expression-injection

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Perspective 5.0.0 contiene una vulnerabilidad de ejecución remota de código que permite a atacantes no autenticados ejecutar comandos arbitrarios del sistema operativo mediante el envío de cadenas de expresión manipuladas al backend de PolarsVirtualServer, el cual pasa la entrada proporcionada por el cliente directamente a eval() de Python con solo __builtins__={} borrado. Los atacantes pueden explotar la transversalidad de atributos de objetos de Python a través de la lista de clases cargadas del intérprete para alcanzar subprocess.Popen a través de un mensaje protobuf TableValidateExprReq o TableMakeViewReq, logrando la ejecución de comandos arbitrarios en el proceso anfitrión de Perspective.

Information

Published : 2026-08-04 15:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-67195

Mitre link : CVE-2026-67195

CVE.ORG link : CVE-2026-67195

JSON object : View

Products Affected

No product.

CWE

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

{"id": "CVE-2026-67195", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67195", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-04T15:05:42.640550Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/perspective-dev/perspective", "vendor": "perspective-dev", "product": "perspective", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.0.0"}], "packageURL": "pkg:github/perspective-dev/perspective", "defaultStatus": "affected"}]}], "published": "2026-08-04T15:16:40.130", "references": [{"url": "https://christbowel.com/blog/perspective-5-0-0-five-cves/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/perspective-rce-via-eval-expression-injection", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-95"}]}], "descriptions": [{"lang": "en", "value": "Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpreter's loaded class list to reach subprocess.Popen via a TableValidateExprReq or TableMakeViewReq protobuf message, achieving arbitrary command execution in the Perspective host process."}, {"lang": "es", "value": "Perspective 5.0.0 contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo que permite a atacantes no autenticados ejecutar comandos arbitrarios del sistema operativo mediante el env\u00edo de cadenas de expresi\u00f3n manipuladas al backend de PolarsVirtualServer, el cual pasa la entrada proporcionada por el cliente directamente a eval() de Python con solo __builtins__={} borrado. Los atacantes pueden explotar la transversalidad de atributos de objetos de Python a trav\u00e9s de la lista de clases cargadas del int\u00e9rprete para alcanzar subprocess.Popen a trav\u00e9s de un mensaje protobuf TableValidateExprReq o TableMakeViewReq, logrando la ejecuci\u00f3n de comandos arbitrarios en el proceso anfitri\u00f3n de Perspective."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}