CVE-2026-67195: high-severity vulnerability in perspective-dev perspective
Perspective 5.0.0 RCE via eval() Expression Injection
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.7epss 1.2%
Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpreter's loaded class list to reach subprocess.Popen via a TableValidateExprReq or TableMakeViewReq protobuf message, achieving arbitrary command execution in the Perspective host process.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
perspective-dev · perspectivepublic PoCs found — 1
cve_referencechristbowel.com/blog/perspective-5-0-0-five-cves/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — perspective-dev perspective
In the same product, most dangerous first.
CVE-2026-67200HIGHPerspective 5.0.0 Path Traversal via cwd_static_file_handlerEPSS 0.9%CVE-2026-67199HIGHPerspective 5.0.0 DoS via Loop Expression EvaluationEPSS 0.5%CVE-2026-67198HIGHPerspective 5.0.0 DoS via VirtualServer Protocol DispatcherEPSS 0.3%CVE-2026-67196MEDIUMPerspective 5.0.0 XSS via Debug Plugin innerHTML InterpolationEPSS 0.3%