Hi,

The following vulnerability was published for python-lupa.

CVE-2026-34444[0]:
| Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6
| and earlier, attribute_filter is not consistently applied when
| attributes are accessed through built-in functions like getattr and
| setattr. This allows an attacker to bypass the intended restrictions
| and eventually achieve arbitrary code execution.

At time of writing, no fix is available.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-34444
https://www.cve.org/CVERecord?id=CVE-2026-34444
[1] https://github.com/scoder/lupa/security/advisories/GHSA-69v7-xpr6-6gjm

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore