Daily updates from Odoo
Wednesday, February 25, 2026
1 change · master
Enhancements to existing features
This update strengthens Odoo's security by adding runtime analysis for code executed through the `safe_eval` tool. It prevents the risk of using untrusted code, ensuring data integrity and protecting against potential vulnerabilities. The system's response to unsafe code is configurable via an environment variable.
Original PR description
The execution of arbitrary code in Odoo via `safe_eval` already takes place in a restricted environment, in particular via prior opcode, `co_names` static analysis and specific builtins in the…
The execution of arbitrary code in Odoo via `safe_eval` already takes place in a restricted environment, in particular via prior opcode, `co_names` static analysis and specific builtins in the evaluation context. The purpose of this commit is to introduce the ability to dynamically analyse code executed via the `safe_eval` tool. The dangerous situation we want to avoid is transferring logic to code that is considered untrusted. In other words, we want to avoid calls that use objects that are not in the whitelist. The behavior to adopt when detecting an unsafe object depends on the `ODOO_UNSAFE_POLICY` environment variable. - `disable`: Disable the feature - `log`: Log a warning (default) - `raise`: Raise an exception - `terminate`: Terminate the process Note: Python 3.12+ is required since the [sys.monitoring](https://docs.python.org/3.12/library/sys.monitoring.html) API is used. The presence of the JSON C extension library is required (`_json`) for performance reasons. _This is not a sandbox in general, but it helps prevent dangerous behavior in the context of `safe_eval`._ Task-4658036