ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape

SummaryIf an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. DetailsThe vulnerability is rooted in how asteval performs handling of FormattedValue AST nodes. In...