CVE-2026-67195
Published: August 4th, 2026
Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpreter's loaded class list to reach subprocess.Popen via a TableValidateExprReq or TableMakeViewReq protobuf message, achieving arbitrary command execution in the Perspective host process.
HIGH
CVSS v3: 8.8
CVSS v3: 8.8
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| 26.3 | protobuf (3.0.0) | Not Affected | Code Not Present | CVE-2026-67195 is an eval injection vulnerability (CWE-95, CVSS 3.1 base 8.8) in Perspective (github.com/perspective-dev/perspective, formerly finos/perspective), a data-visualization and analytics component. The flaw is in Perspective’s own PolarsVirtualServer backend, which passes a client-supplied expression string directly to Python’s eval() with only builtins emptied, so attribute traversal reaches subprocess.Popen. The CVE was flagged against Document Filters because the scanner matched the word ‘protobuf’ in the description — TableValidateExprReq and TableMakeViewReq are Perspective’s own request message types used to carry the attacker expression — but the vulnerability is not in the protobuf library itself. Debian’s security tracker records this CVE as NOT-FOR-US: Perspective, confirming it is not a protobuf issue. Perspective is not present in Document Filters in any form: the PolarsVirtualServer backend, the Polars dataframe engine, and the TableValidateExprReq and TableMakeViewReq message types do not exist anywhere in this tree. Document Filters also has no expression-evaluation surface of this kind — it embeds no Python interpreter, ships no network server that could be remotely reached, and contains no eval() call on caller-supplied input. Our protobuf usage is exclusively the C++ protobuf library v3.0.0 compiled from source (external/protobuf-3.0.0/src via build/isys_module_net.lua) for runtime deserialization of Apple iWork archive structures; the protobuf Python runtime is not present or built. |
| 26.2 | protobuf (3.0.0) | Needs Triage | ||
| 26.1 | protobuf (3.0.0) | Needs Triage | ||
| 25.4 | protobuf (3.0.0) | Needs Triage | ||
| 25.3 | protobuf (3.0.0) | Needs Triage | ||
| 25.2 | protobuf (3.0.0) | Needs Triage | ||
| 25.1 | protobuf (3.0.0) | Needs Triage | ||
| 24.4 | protobuf (3.0.0) | Needs Triage | ||
| 24.4.0 | protobuf (3.0.0) | Needs Triage | ||
| 24.3 | protobuf (3.0.0) | Needs Triage | ||
| 24.2 | protobuf (3.0.0) | Needs Triage | ||
| 24.1 | protobuf (3.0.0) | Needs Triage | ||
| 23.3 | protobuf (3.0.0) | Needs Triage | ||
| 23.2 | protobuf (3.0.0) | Needs Triage | ||
| 23.1 | protobuf (3.0.0) | Needs Triage | ||
| 22.4 | protobuf (3.0.0) | Needs Triage | ||
| 22.3 | protobuf (3.0.0) | Needs Triage | ||
| 22.2 | protobuf (3.0.0) | Needs Triage | ||
| 22.1 | protobuf (3.0.0) | Needs Triage | ||
| 21.11 | protobuf (3.0.0) | Needs Triage | ||
| 21.8 | protobuf (3.0.0) | Needs Triage | ||
| 21.5.0 | protobuf (3.0.0) | Needs Triage | ||
| 21.2.0 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.19.3667 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.18.3599 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.16.3445 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.15.3368 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.14.3263 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.13.3179 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.12.3054 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.11.3040 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.11.2990 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.10.2934 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.9.2878 | protobuf (3.0.0) | Needs Triage | ||
| 11.4.8.2822 | protobuf (3.0.0) | Needs Triage |
Severity score breakdown
Attack Complexity
LOW
Attack Vector
NETWORK
Availability Impact
HIGH
Base Score
8.8
Base Severity
HIGH
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Privileges Required
LOW
Scope
UNCHANGED
User Interaction
NONE
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Version
3.1