Intel

AIKIDO-2026-768557

starlark-pyo3 is vulnerable to Incorrect Conversion between Numeric Types

Incorrect Conversion between Numeric TypesGHSA-8qg4-mgfw-4p63 Published Today

53

Medium Risk

This Affects:

PYTHONstarlark-pyo3
2026.1.1 - 2026.1.1
Fixed in 2026.1.2
Are you affected? Scan for Free

TL;DR

When Python integers larger than the u64/i64 range are passed into the Starlark sandbox, pyobject_to_value routes them through JSON serialization where the BigInt fallback branch was commented out, so they silently widen to 64-bit floats instead of becoming Starlark integers. Distinct large integers then compare equal and lose precision, so checks such as amount <= limit can pass when they should fail, with no error raised. The widening is invisible from Starlark because reads return the corrupted values. The fix converts Python integers directly to arbitrary-precision Starlark integers.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you pass externally influenced Python integers larger than 64 bits into the Starlark sandbox and rely on their exact values.

Background info

starlark-pyo3 is vulnerable to Incorrect Conversion between Numeric Types in versions 2026.1.1 - 2026.1.1.

How to fix this

Upgrade the starlark-pyo3 and/or the starlark_pyo3 library to the patch version.

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform