CVE-2026-67195: Perspective-Dev Perspective

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpreter's loaded class list to reach subprocess.Popen via a TableValidateExprReq or TableMakeViewReq protobuf message, achieving arbitrary command execution in the Perspective host process.

Affected products

• Perspective-Dev Perspective: up to and including 5.0.0

Published 2026-08-04. Last modified 2026-09-09.