AIKIDO-2025-10460
petl is vulnerable to Improper Control of Generation of Code ('Code Injection')
78
High Risk
This Affects:
petlTL;DR
Affected versions of this package are vulnerable to Arbitrary Code Execution due to unsafe eval() usage in util.base.expr. The vulnerability occurs when user-controlled inputs s are improperly sanitized before being embedded into a lambda expression string that is dynamically evaluated. An attacker can exploit this by injecting malicious Python code within the input string, which breaks out of the intended lambda rec:context and executes arbitrary commands with the application's privileges, potentially leading to system compromise or data exfiltration.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
petl is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 1.0.0 - 1.7.16.
How to fix this
Upgrade the petl library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant