CVE-2026-34444

EUVD-2026-19346
Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
10 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 46.74%
Affected Products (NVD)
VendorProductVersion
scoderlupa
𝑥
≤ 2.6
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Satellite 6.18
1780492008 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
python-lupa
bookworm
no-dsa
bullseye
postponed
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-lupa
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
Common Weakness Enumeration
References
https://github.com/scoder/lupa/security/advisories/GHSA-69v7-xpr6-6gjm
https://access.redhat.com/errata/RHSA-2026:22993
https://access.redhat.com/security/cve/CVE-2026-34444
https://bugzilla.redhat.com/show_bug.cgi?id=2455413
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34444.json