AIKIDO-2025-10623
pydantic-evals is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
90
Critical Risk
This Affects:
pydantic-evalsTL;DR
Affected versions of this package are vulnerable to Remote Code Execution via the Python evaluator due to the use of the eval() function on user-controlled input from the expression field. An attacker with the ability to control or maliciously craft this input could supply a malicious Python expression that would be executed within the application's context, potentially allowing them to access sensitive data, modify application state, or perform other destructive actions by leveraging the exposed ctx object.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
pydantic-evals is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in versions 0.0.47 - 1.0.0.
How to fix this
Upgrade the pydantic-evals library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant