starlark-pyo3 is vulnerable to Incorrect Conversion between Numeric Types
53
Medium Risk
When Python integers larger than the u64/i64 range are passed into the Starlark sandbox, pyobject_to_value routes them through JSON serialization where the BigInt fallback branch was commented out, so they silently widen to 64-bit floats instead of becoming Starlark integers. Distinct large integers then compare equal and lose precision, so checks such as amount <= limit can pass when they should fail, with no error raised. The widening is invisible from Starlark because reads return the corrupted values. The fix converts Python integers directly to arbitrary-precision Starlark integers.
You are affected if you are using a version that falls within the vulnerable range and you pass externally influenced Python integers larger than 64 bits into the Starlark sandbox and rely on their exact values.
starlark-pyo3 is vulnerable to Incorrect Conversion between Numeric Types in versions 2026.1.1 - 2026.1.1.
Upgrade the starlark-pyo3 and/or the starlark_pyo3 library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.