Description
Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
scoder lupa
<= 2.6affected
References
- https://github.com/scoder/lupa/security/advisories/GHSA-69v7-xpr6-6gjm ↗
- https://access.redhat.com/security/cve/CVE-2026-34444 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2455413 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34444.json ↗
- https://access.redhat.com/errata/RHSA-2026:22993 ↗