CVE-2026-31225— superduper 安全漏洞

N/A

The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server.

N/A

N/A

superduper 安全漏洞

superduper是superduper.io开源的一个数据库集成AI代理与应用构建工具。 superduper v0.10.0及之前版本存在安全漏洞，该漏洞源于查询解析组件中的_parse_op_part()函数使用不安全的eval()动态评估用户提供的查询操作数，未进行适当的清理或限制，远程攻击者可通过提交特制查询字符串包含Python代码导入模块并执行任意系统命令，导致服务器完全被攻破。

N/A

N/A