7.9
High
CVE-2026-34444 Lupa integrates the runtimes of Lua or LuaJIT2 into CPython
Description
Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| lupa 2.6 | earliest → 2.6 | No fix stated |
| Red Hat Satellite 6.18 1780492008 | earliest → < 1780492008 | 1780492008 |
| Red Hat OpenShift AI (RHOAI) | Versions not published |
References
- github.com github.com
Timeline
- Published
- Last modified