CVE-2026-67195
HighCVSS 8.8Summary
Perspective 5.0.0 contains a remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary OS commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes input directly to Python's eval().
Risk Assessment
An attacker can fully compromise the Perspective host process, leading to complete system compromise.
Recommendation
Update Perspective to a patched version and restrict access to the PolarsVirtualServer backend.
Other vulnerabilities in Perspective
See all- CVE-2026-67199Medium
Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large iteration count in an expression column evaluated once per table row, causing the Tornado IOLoop to block without any iteration cap, deadline, or cancellation check, rendering the server unresponsive to all connected clients.
- CVE-2026-67198High
Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher allowing unauthenticated attackers to crash the server process by sending malformed or incomplete protobuf messages.
- CVE-2026-67200High
Perspective 5.0.0 contains a path traversal vulnerability allowing unauthenticated attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths.
- CVE-2026-67196Medium
Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization rendering. Attackers can craft table rows with payloads such as unquoted attribute injections containing event handler attributes that bypass RFC 4180 quoting, since angle brackets and event handler attributes are never escaped before assignment, causing malicious scripts to execute in the embedding page's origin.
Original NVD description (English source)
Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpreter's loaded class list to reach subprocess.Popen via a TableValidateExprReq or TableMakeViewReq protobuf message, achieving arbitrary command execution in the Perspective host process.