AIKIDO-2025-10962

TL;DR

Affected versions of this package are vulnerable to denial-of-service and memory exhaustion attacks due to unsafe expression parsing in scenarios such as user-settable pre_dispatch expressions. The ast.parse function can crash the Python interpreter with long and complex expressions. Evaluating expressions such as 9**9**9**9 leads to prolonged computation times (DoS), and allocating large strings from concise expressions like ' ' * 10**10 triggers memory exhaustion (OOM). An attacker can exploit these vulnerabilities by submitting malicious expressions to accessible parameters, causing interpreter crashes, service degradation, or system resource depletion.