What is CVE-2026-32640?

CVE-2026-32640 is a critical-severity vulnerability in Danthedeckie Simpleeval, classified under Code Injection. CVSS score: 9.8/10. Published 2026-03-16.

How severe is CVE-2026-32640?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Danthedeckie Simpleeval

CVE-2026-32640

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.005 (41.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Danthedeckie Simpleeval — versions < 1.0.5

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Frequently asked questions

What is CVE-2026-32640?: CVE-2026-32640 is a critical-severity vulnerability in Danthedeckie Simpleeval, classified under Code Injection. CVSS score: 9.8/10. Published 2026-03-16.
How severe is CVE-2026-32640?: Critical severity. CVSS v3 base score is 9.8 out of 10.