superduper-framework
Build compositional and declarative AI applications and agents
View on Github
Activity
- Latest release
- 1y ago
- Total releases
- 60
- Cadence
- ~daily
- Last 12 months
- 0
Reach
- Stars
- —
Details
- License
- custom
- First release
- Jul 12, 2024
| Version | Released | |
|---|---|---|
0.10.0
minor
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.9.0
minor
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.8.2
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.8.1
minor
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.7.3
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.7.2
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.7.1
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.7.0
minor
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.40
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.39
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.6.7
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.6.6
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.6.5
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.6.4
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.38
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.37
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.36
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.6.3
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.6.1
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.6.0
minor
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.35
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.34
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.33
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.32
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.31
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.30
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.29
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.28
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.27
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.26
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.25
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.24
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.23
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.22
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.21
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.20
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.19
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.18
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.17
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.16
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.15
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.14
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.13
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.11
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.10
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.9
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.8
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.5
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.4
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.5.3
patch
1 CVE
CVE-2026-31225
PYSEC-2026-3077
GHSA-2799-6g5r-mmc7
Jul 13, 2026
Superduper: Remote code execution via unsafe eval in superduper query parsing
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server. Affected versions
0.10.0
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.5.0
0.5.1
0.5.10
0.5.11
+ 48 more Show less
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.2
0.5.20
0.5.21
0.5.22
0.5.23
0.5.24
0.5.25
0.5.26
0.5.27
0.5.28
0.5.29
0.5.3
0.5.30
0.5.31
0.5.32
0.5.33
0.5.34
0.5.35
0.5.36
0.5.37
0.5.38
0.5.39
0.5.4
0.5.40
0.5.5
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.8.1
0.8.2
0.9.0
References Updated Jul 13, 2026 · Source: OSV.dev |