CVE-2026-34444

Summary

Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.

Affected Software

Weaknesses

• CWE-284: CWE-284: Improper Access Control
• CWE-639: CWE-639: Authorization Bypass Through User-Controlled Key

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

lupa: Lupa: Arbitrary Code Execution due to inconsistent attribute filtering

Additional References

• https://access.redhat.com/security/cve/CVE-2026-34444
• https://bugzilla.redhat.com/show_bug.cgi?id=2455413
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34444.json
• https://access.redhat.com/errata/RHSA-2026:22993

References

• https://github.com/scoder/lupa/security/advisories/GHSA-69v7-xpr6-6gjm

• ←Previous
• Next→