ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Interpreter.eval(), while run() and eval() in asteval/asteval.py catch Exception rather than these non-Exception BaseException subclasses. When an attacker-controlled expression raises one of these classes, on_raise() passes the class to raise_exception(), and the resulting exception bypasses the interpreter's safety handlers and propagates into the calling application. A consuming service that evaluates untrusted expressions can therefore be terminated or have signal and cleanup handling disrupted, causing denial of service. The separately documented read-only open() capability is not part of this vulnerability. This issue is fixed in version 1.0.9.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in     asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions     evaluated by asteval.Interpreter.eval(), while run() and eval() in asteval/asteval.py catch Exception     rather than these non-Exception BaseException subclasses. When an attacker-controlled expression raises     one of these classes, on_raise() passes the class to raise_exception(), and the resulting exception     bypasses the interpreter's safety handlers and propagates into the calling application. A consuming     service that evaluates untrusted expressions can therefore be terminated or have signal and cleanup     handling disrupted, causing denial of service. The separately documented read-only open() capability is     not part of this vulnerability. This issue is fixed in version 1.0.9. (CVE-2026-55244)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in
    asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions
    evaluated by asteval.Interpreter.eval(), while run() and eval() in asteval/asteval.py catch Exception
    rather than these non-Exception BaseException subclasses. When an attacker-controlled expression raises
    one of these classes, on_raise() passes the class to raise_exception(), and the resulting exception
    bypasses the interpreter's safety handlers and propagates into the calling application. A consuming
    service that evaluates untrusted expressions can therefore be terminated or have signal and cleanup
    handling disrupted, causing denial of service. The separately documented read-only open() capability is
    not part of this vulnerability. This issue is fixed in version 1.0.9. (CVE-2026-55244)

ID	Name	Product	Family	Type	Severity
346334	Linux Distros Unpatched Vulnerability : CVE-2026-55244	Nessus	Misc.	Local	medium
446175	SCA: security update for asteval (GHSA-89v8-rhwq-hf77)	Tenable Cloud Security	SCA Checks	Local	medium
446175	SCA: security update for asteval (GHSA-89v8-rhwq-hf77)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-55244

medium

Tenable Plugins

medium

medium

medium