CVE-2026-34444: Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-06 · updated 2026-10-26
Weakness: CWE-284

Description

Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.

Affected products

scoder lupa: through 2.6

References

https://github.com/scoder/lupa/security/advisories/GHSA-69v7-xpr6-6gjm
https://access.redhat.com/errata/RHSA-2026:22993
https://access.redhat.com/security/cve/CVE-2026-34444
https://bugzilla.redhat.com/show_bug.cgi?id=2455413
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34444.json

Get alerted when CVE-2026-34444 or the next vulnerability affects your stack