Whats new for prop_cycle rcparam

scottshambaugh · scottshambaugh · commit 45b6acd5257b · 2026-03-09T14:12:40.000-06:00
diff --git a/doc/release/next_whats_new/cycler_rcparam_security.rst b/doc/release/next_whats_new/cycler_rcparam_security.rst
@@ -0,0 +1,10 @@
+``axes.prop_cycle`` rcParam must be literal
+--------------------------------------------
+
+The ``axes.prop_cycle`` rcParam is now parsed safely without ``eval()``. Only
+literal ``cycler()`` calls combined with ``+`` and ``*`` are allowed. All
+previously valid cycler strings continue to work, for example:
+
+.. code-block:: none
+
+   axes.prop_cycle : cycler('color', ['r', 'g', 'b']) + cycler('linewidth', [1, 2, 3])
diff --git a/lib/matplotlib/rcsetup.py b/lib/matplotlib/rcsetup.py
@@ -847,9 +847,8 @@ def _eval_cycler_expr(node):
     if isinstance(node, ast.Call):
         if not (isinstance(node.func, ast.Name) and node.func.id == 'cycler'):
             raise ValueError("only the 'cycler()' function is allowed")
-        args = [ast.literal_eval(ast.unparse(a)) for a in node.args]
-        kwargs = {kw.arg: ast.literal_eval(ast.unparse(kw.value))
-                  for kw in node.keywords}
+        args = [ast.literal_eval(a) for a in node.args]
+        kwargs = {kw.arg: ast.literal_eval(kw.value) for kw in node.keywords}
         return cycler(*args, **kwargs)
     raise ValueError(
         f"Unsupported expression in cycler string: {ast.dump(node)}")
