CVE-2026-34444: Sandbox Escape and Remote Code Execution in Lupa
Vulnerability ID: CVE-2026-34444
CVSS Score: 7.9
Published: 2026-04-07
CVE-2026-34444 is a critical sandbox escape vulnerability in the Lupa Python library, allowing remote code execution. The flaw arises from an incomplete attribute_filter implementation that fails to hook Python built-in functions like getattr and setattr, enabling attackers to bypass restrictions and access sensitive internal attributes.
TL;DR
Lupa <= 2.6 fails to enforce attribute_filter on Python built-ins like getattr(). Attackers can exploit this to access class and mro, resulting in a sandbox escape and RCE. Update to Lupa 2.7+ or disable register_builtins.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-284, CWE-639
- Attack Vector: Network
- CVSS 4.0: 7.9 (High)
- EPSS Score: 0.00068 (20.77%)
- Impact: Remote Code Execution (RCE)
- Exploit Status: PoC Available
- CISA KEV: Not Listed
Affected Systems
- Lupa Python Library
- Python environments utilizing LuaJIT2/Lua integration via Lupa
- Applications executing untrusted Lua scripts with register_builtins enabled
-
lupa: <= 2.6 (Fixed in:
2.7)
Mitigation Strategies
- Update Lupa library to version 2.7 or higher
- Disable Python built-ins registration in Lua environments
- Implement explicit allowlisting for exposed Python functions
Remediation Steps:
- Identify all instances of LuaRuntime initialization in the codebase
- Verify and explicitly set register_builtins=False if not required
- Update the project dependencies to require lupa>=2.7
- Review custom attribute_filter implementations to ensure they reject unknown or complex attributes
References
Read the full report for CVE-2026-34444 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)