Unauthenticated Remote Code Execution in Perspective 5.0.0

Perspective version 5.0.0 contains a critical remote code execution vulnerability (CVE-2026-67195) located within its PolarsVirtualServer backend component. The vulnerability originates from the unsafe handling of client-supplied expression strings, which are passed directly to Python's eval() function. Although the application attempts to restrict the environment by clearing builtins, this mechanism is insufficient as it does not prevent object attribute traversal. An attacker can leverage this limitation to traverse the interpreter's loaded class hierarchy, eventually accessing subprocess.Popen to execute arbitrary operating system commands. This flaw is reachable by unauthenticated attackers who can deliver specially crafted TableValidateExprReq or TableMakeViewReq protobuf messages to the service. Given that Perspective is often deployed in data-intensive environments, successful exploitation allows an attacker to gain full control over the host process and the underlying system.

Impact

Successful exploitation of this vulnerability results in unauthenticated remote code execution with the privileges of the Perspective host process. This can lead to full system compromise, data exfiltration, or the deployment of further post-exploitation payloads. All instances of Perspective 5.0.0 are considered high-risk until patched.

Recommendation

• Identify all deployments of Perspective 5.0.0 in the environment and verify if they are internet-facing.
• Implement network-level access controls to restrict access to the PolarsVirtualServer service to trusted management segments only.
• Prioritize upgrading Perspective to a patched version once provided by the vendor.
• Monitor server logs for incoming traffic containing protobuf serialization patterns associated with TableValidateExprReq or TableMakeViewReq types if application-level inspection is available.