GHSA-44vg-5wv2-h2hg SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox

• PyPI simpleeval: < 1.0.5 → fixed in 1.0.5

Impact If the objects passed in as `names` to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. Examples (found by @ByamB4): Any module where non-underscore attribute chains reach os or sys: • os.path, pathlib, shutil, glob (direct .os / .sys attributes) • statistics (has .sys) • numpy (has .ctypeslib.os and .f2py.sys) • urllib.parse (has .warnings.sys) Patches The latest version 1.0.5 has this issue fixed. Workarounds Don't pass in objects or modules which have direct attributes to potentially dangerous items. Use a wrapper to wrap the potentially vulnerable items (See the ModuleWrapper in version 1.0.5)