CVE-2026-67195
Perspective 5.0.0 RCE via eval() Expression Injection
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpreter's loaded class list to reach subprocess.Popen via a TableValidateExprReq or TableMakeViewReq protobuf message, achieving arbitrary command execution in the Perspective host process.
| CWE | CWE-95 |
| Vendor | perspective-dev |
| Product | perspective |
| Published | Aug 4, 2026 |
| Last Updated | Aug 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for perspective-dev perspective
Be the first to know when new high vulnerabilities affecting perspective-dev perspective are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
perspective-dev / perspective
0 ≤ 5.0.0
References
Credits
Christ Bowel Bouchuen