GHSA-HP3V-5VW7-FX9W
Vulnerability from github – Published: 2026-09-17 16:30 – Updated: 2026-09-17 16:30Impact
RestrictedPython could allow a sandbox escape when a policy exposes the standard library string module, or otherwise exposes string.Formatter, to restricted code.
string.Formatter field resolution methods such as get_field can perform attribute and item traversal internally and return live object references. This can bypass RestrictedPython's normal attribute guards and may allow access to sensitive objects such as function globals, builtins, file access, or code execution primitives.
Users are impacted if they run untrusted code with RestrictedPython and expose string.Formatter, directly or indirectly, for example through a custom import policy or globals.
Patches
The problem has been patched by blocking access to string.Formatter and unsafe string.Formatter traversal methods in safer_getattr.
Users should upgrade to the patched release once available. Affected and patched version numbers should be filled in when the release is published.
Workarounds
Do not expose the standard library string module or string.Formatter to restricted code.
If a custom import hook is used, deny imports of string or provide only a restricted wrapper that does not expose Formatter. If custom globals are supplied, ensure neither string.Formatter nor Formatter instances are available to restricted code.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "RestrictedPython"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-76825"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-470",
"CWE-680",
"CWE-693"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-17T16:30:22Z",
"nvd_published_at": "2026-09-16T15:17:46Z",
"severity": "HIGH"
},
"details": "### Impact\nRestrictedPython could allow a sandbox escape when a policy exposes the standard library `string` module, or otherwise exposes `string.Formatter`, to restricted code.\n\n`string.Formatter` field resolution methods such as `get_field` can perform attribute and item traversal internally and return live object references. This can bypass RestrictedPython\u0027s normal attribute guards and may allow access to sensitive objects such as function globals, builtins, file access, or code execution primitives.\n\nUsers are impacted if they run untrusted code with RestrictedPython and expose `string.Formatter`, directly or indirectly, for example through a custom import policy or globals.\n\n### Patches\nThe problem has been patched by blocking access to `string.Formatter` and unsafe `string.Formatter` traversal methods in `safer_getattr`.\n\nUsers should upgrade to the patched release once available. Affected and patched version numbers should be filled in when the release is published.\n\n### Workarounds\nDo not expose the standard library `string` module or `string.Formatter` to restricted code.\n\nIf a custom import hook is used, deny imports of `string` or provide only a restricted wrapper that does not expose `Formatter`. If custom globals are supplied, ensure neither `string.Formatter` nor `Formatter` instances are available to restricted code.",
"id": "GHSA-hp3v-5vw7-fx9w",
"modified": "2026-09-17T16:30:22Z",
"published": "2026-09-17T16:30:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-hp3v-5vw7-fx9w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76825"
},
{
"type": "WEB",
"url": "https://github.com/zopefoundation/RestrictedPython/commit/3b47440070b91f8807c2b2998aca99e94783639a"
},
{
"type": "PACKAGE",
"url": "https://github.com/zopefoundation/RestrictedPython"
},
{
"type": "WEB",
"url": "https://github.com/zopefoundation/RestrictedPython/releases/tag/8.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.