CVE-2026-67195

This is a remote code execution vulnerability in Perspective 5.0.0 where the intended security control — clearing `__builtins__` — provides virtually no protection against a motivated attacker. The protobuf message handlers TableValidateExprReq and TableMakeViewReq accept client-supplied expressions and evaluate them through eval() with only `__builtins__={}` as the barrier. This mitigation fails completely because clearing __builtins__ removes only the shorthand names for built-in functions; it does not remove built-in types or break the type hierarchy that Python exposes through type.__subclasses__(). An attacker with control over the expression string can invoke type.__subclasses__() to obtain a list of all currently loaded classes in the interpreter, traverse that list to locate subprocess.Popen, and instantiate it with arbitrary shell commands. This technique has been documented since at least 2012 and appears in every standard Python sandbox escape training module — it is not a novel or clever bypass but the canonical failure mode for __builtins__={} sanitization. The protobuf interface being the attack surface is notable: this is not a forgotten debug endpoint but a structured, presumably intentional API layer. That means the eval capability was an architectural decision, not accidental exposure. Do not attempt to patch this by restricting __subclasses__ or implementing custom containment — those measures are routinely bypassed. The only reliable remediation is removing the eval path entirely from the protobuf handlers. As a defender, you should: confirm whether TableValidateExprReq and TableMakeViewReq are exposed without authentication in your deployment, treat any eval() path in network-facing code as immediate critical risk regardless of apparent sanitization, and audit other protobuf handlers in the same service for similar patterns — if one team believed __builtins__={} was sufficient, they likely applied similar logic elsewhere. The vulnerability is straightforward: code that should not exist was built, secured with a measure that has never worked, and exposed to the network.

Reviewed through automated stages and approved by a human before publication.