CVE-2026-31225
Severity CVSS v4.0:
Pending analysis
Type:
CWE-94
Code Injection
Publication date:
12/05/2026
Last modified:
13/05/2026
Description
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server.
Impact
Base Score 3.x
8.80
Severity 3.x
HIGH