Riskcovery

CVE-2026-34444

Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr

State
Published
Severity
7.9 High
Published
Apr 6, 2026
Updated
Jul 15, 2026
Reserved
Mar 27, 2026

Read the record on cve.org

Description

Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.

Scores

CVSSScoreVectorSource
4.07.9 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:HGitHub_M
3.18.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hredhat-SADP

Weaknesses

  • CWE-284 Improper Access Control
  • CWE-639 Authorization Bypass Through User-Controlled Key
  • CWE-914 Improper Control of Dynamically-Identified Variables

Affected Products

ProductVersions
lupascoder
  • <= 2.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.