QwikSec

Security Database

CVE

CWE

Training

CVE-2026-34444

Published: Apr 6, 2026

Modified: Apr 6, 2026

PUBLISHED

Description

Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.

Vendor	Product	Versions
scoder	lupa	affected `<= 2.6`

Weaknesses (CWE)

References

https://github.com/scoder/lupa/security/advisories/GHSA-69v7-xpr6-6gjm

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.