Lupa integrates the Lua or LuaJIT2 runtime into CPython, enabling Lua scripts to run inside a Python process. The vulnerability stems from incomplete application of the attribute_filter— a mechanism intended to restrict access to privileged internal members. When CPython processes built‑in operations such as getattr and setattr, the filter is not consistently enforced, allowing an attacker to read or modify restricted attributes. This bypass ultimately permits execution of arbitrary code within the host Python interpreter, exposing the entire process to attack.

The flaw affects the scoder:lupa package, specifically installations that rely on version 2.6 or older. Any Python application that imports or utilizes these earlier Lupa releases, especially when executing untrusted code that employs built‑in attribute access functions, is at risk.

The CVSS base score of 7.9 classifies this as a high‑severity remote code execution flaw. No public EPSS score is available and the vulnerability is not currently listed in the CISA KEV catalog, implying limited known exploitation. Exploitation requires an attacker to influence attribute access within a CPython process that has loaded the vulnerable Lupa extension, such as by executing or importing untrusted Python modules that invoke getattr or setattr on Lua objects. Successful exploitation would grant full control over the Python process and, by extension, the host system.