CVE-2026-67195

Description

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpreter's loaded class list to reach subprocess.Popen via a TableValidateExprReq or TableMakeViewReq protobuf message, achieving arbitrary command execution in the Perspective host process.

Overview

State: PUBLISHED
Assigner (CNA): VulnCheck
CVSS severity: HIGH
CVSS score: 8.7 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Effective score: 8.7 / 10 HIGH source: CNA overview
CWE(s): CWE-95
Reserved: 2026-07-28
Published: 2026-08-04 14:03 UTC
Last updated: 2026-08-04 15:06 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67195.json
Linked Threat: CVE-2026-67195 — Perspective 5.0.0 RCE via eval() Expression Injection

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-52692

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
perspective-dev	perspective	`0` (affected)	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

Researcher Disclosure technical-descriptionexploit
https://www.vulncheck.com/advisories/perspective-rce-via-eval-expression-injection third-party-advisory

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

[Updates] Patch Notes Version 1.15.00 | Crimson Desert

web:crimsondesert.pearlabyss.com

Fellow Greymanes, Here are the fixes and improvements that have been added this patch . Major UpdatesThis patch adds various bug fixes and stability improvements. Update ScheduleThe patch is rolling out across all platforms. Please refer to the Update section below to see the state of the patch ...

2026-08-06 01:15 UTC
Palm Springs Local News - Patch

web:patch.com

Palm Springs Latest Headlines: In-N-Out Mass Shooting Victim From SoCal: 'He Helped Hundreds Of People'; Fire Destroys 2 Homes In Desert Hot Springs; 7 Capital Gains Mistakes Seniors Should Look ...

2026-08-06 01:15 UTC
Security Update Guide - Microsoft Security Response Center

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-08-06 01:15 UTC
N-central 2026.3 Hotfix 1 - Mitigation for CVE-2026-18577

web:status.n-able.com

If you identify any of these, contact N-able support immediately and engage your own security team. Supported Upgrade Paths Upgrade directly to 2026.3.1 from 2025.4 2026.1 2026.2 2026.3 If you are on an older version, we recommend going to any of the builds above. Then upgrade to this Hotfix version ASAP. If you are unsure of what to do, you can contact support directly. Do I need to update my ...

2026-08-06 01:15 UTC
Halo Campaign Evolved Patch Notes - July 29, 2026

web:support.halowaypoint.com

July 29 Patch Overview This update to Halo: Campaign Evolved brings enhanced stability across multiple platforms, adjustments to multiple enemy AI behaviors, and more.

2026-08-06 01:15 UTC
N-central Security Update - August 4, 2026 - N-able

web:www.n-able.com

As our investigation progressed, we determined the vulnerability affected all versions of N‑central and released a comprehensive hotfix (2026.3.1.7) on August 2: N‑central 2026.3 Hotfix 1 - Mitigation for CVE - 2026 -18577.

2026-08-06 01:15 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

Oracle Critical Patch Update Advisory - April 2026 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical Patch ...

2026-08-06 01:15 UTC
patch.moe - Age Verification

web:www.patch.moe

Age Verification Are you 18 years or older? YES NO

2026-08-06 01:15 UTC
Windows 11 KB5121767 released to fix shutdowns ... - Windows Latest

web:www.windowslatest.com

Microsoft just dropped Windows 11 KB5121767, an emergency update that replaces the July 2026 cumulative update on PCs.

2026-08-06 01:15 UTC
Patch Tuesday August 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's August 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-08-06 01:15 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-67195.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67195",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T15:05:42.640550Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T15:06:09.203Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/perspective-dev/perspective",
          "product": "perspective",
          "repo": "https://github.com/perspective-dev/perspective",
          "vendor": "perspective-dev",
          "versions": [
            {
              "lessThanOrEqual": "5.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christ Bowel Bouchuen"
        }
      ],
      "datePublic": "2026-08-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpreter's loaded class list to reach subprocess.Popen via a TableValidateExprReq or TableMakeViewReq protobuf message, achieving arbitrary command execution in the Perspective host process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T14:03:17.891Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Researcher Disclosure",
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://christbowel.com/blog/perspective-5-0-0-five-cves/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/perspective-rce-via-eval-expression-injection"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Perspective 5.0.0 RCE via eval() Expression Injection",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-67195",
    "datePublished": "2026-08-04T14:03:17.891Z",
    "dateReserved": "2026-07-28T16:06:49.774Z",
    "dateUpdated": "2026-08-04T15:06:09.203Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}