A flaw in the Lupa library, which embeds Lua or LuaJIT2 runtimes in CPython, causes the attribute_filter protection to be inconsistently applied when attributes are accessed through built‑in functions such as getattr and setattr. The result is that an attacker who can supply code that uses these operations can bypass the intended restrictions and ultimately execute arbitrary code on the host system.

The vulnerability affects the scoder:Lupa product. Versions 2.6 and earlier are impacted; higher versions have fixed the attribute_filter enforcement issue.

The CVSS score is 7.9, indicating a high severity. EPSS data is not available and the vulnerability is not in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. Based on the description, it is inferred that the attack vector is remote code execution via Python scripts that utilize Lupa. An attacker would need to supply a Lua script that calls Python built‑ins, a scenario that is feasible in many environments that allow user‑supplied Lua or Python code. The impact is system‑wide, as arbitrary code can be run with the privileges of the process that loaded Lupa.