Vulnerability Description
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/superduper-io/superduper
- https://www.notion.so/CVE-2026-31225-35d1e1393188814f99b5eec7b6517190
FAQ
What is CVE-2026-31225?
CVE-2026-31225 is a vulnerability with a CVSS score of 8.8 (HIGH). The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to...
How severe is CVE-2026-31225?
CVE-2026-31225 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-31225?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.