GHSA-FFG3-P8FM-MJX2
Vulnerability from github – Published: 2026-08-28 22:51 – Updated: 2026-08-28 22:51Impact
RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes _getattr_(obj, name), item access becomes _getitem_(obj, key), writes go through _write_, and print goes through _print_. The embedding application supplies these hooks to enforce its policy.
Argument-name validation rejects these protected names for regular arguments, *args, **kwargs, and keyword-only arguments, but it misses positional-only arguments (the ones before /). So a function like:
def f(_getattr_=evil, /):
return o.x
makes _getattr_ a local that shadows the policy hook, and the rewritten access calls evil instead. The same works for _getitem_, _write_, and _print_. Shadowing _print_ can also be used to capture the internal _getattr_ hook that RestrictedPython passes in.
The result is that sandboxed code can bypass the access policy the embedding application relies on. In applications that also handle sandbox-controlled objects unsafely (for example serializing them with pickle), this primitive can be chained further, up to remote code execution. That part depends on the embedding application, but the underlying guard bypass is in RestrictedPython.
Proof of concept
On an unpatched RestrictedPython this prints shadowed and an empty calls list, meaning the policy _getattr_ never ran. With the fix, compile_restricted rejects the code.
from RestrictedPython import compile_restricted
from RestrictedPython.Guards import safe_globals, safer_getattr
calls = []
def policy_getattr(obj, name, default=None):
calls.append(name) # the real guard records every access
return safer_getattr(obj, name, default)
src = """
def f(o, _getattr_=lambda obj, name: "shadowed", /):
return o.x
"""
code = compile_restricted(src, "<s>", "exec") # currently compiles, should be rejected
g = dict(safe_globals)
g["_getattr_"] = policy_getattr
exec(code, g)
class O:
x = "secret"
print(g["f"](O())) # -> "shadowed" (attacker's local was used)
print(calls) # -> [] (policy _getattr_ never ran)
Patches
The fix validates positional-only argument names the same way the other argument kinds are already validated. It will ship in the next release.
Workarounds
None other than upgrading. If you cannot upgrade immediately, reject any submitted code whose function or lambda definitions use positional-only parameters with leading-underscore names before compiling.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.2"
},
"package": {
"ecosystem": "PyPI",
"name": "RestrictedPython"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55830"
],
"database_specific": {
"cwe_ids": [
"CWE-184"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-28T22:51:35Z",
"nvd_published_at": "2026-07-08T22:17:15Z",
"severity": "HIGH"
},
"details": "### Impact\n\nRestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes `_getattr_(obj, name)`, item access becomes `_getitem_(obj, key)`, writes go through `_write_`, and print goes through `_print_`. The embedding application supplies these hooks to enforce its policy.\n\nArgument-name validation rejects these protected names for regular arguments, `*args`, `**kwargs`, and keyword-only arguments, but it misses positional-only arguments (the ones before `/`). So a function like:\n\n```python\ndef f(_getattr_=evil, /):\n return o.x\n```\n\nmakes `_getattr_` a local that shadows the policy hook, and the rewritten access calls `evil` instead. The same works for `_getitem_`, `_write_`, and `_print_`. Shadowing `_print_` can also be used to capture the internal `_getattr_` hook that RestrictedPython passes in.\n\nThe result is that sandboxed code can bypass the access policy the embedding application relies on. In applications that also handle sandbox-controlled objects unsafely (for example serializing them with pickle), this primitive can be chained further, up to remote code execution. That part depends on the embedding application, but the underlying guard bypass is in RestrictedPython.\n\n### Proof of concept\n\nOn an unpatched RestrictedPython this prints `shadowed` and an empty `calls` list, meaning the policy `_getattr_` never ran. With the fix, `compile_restricted` rejects the code.\n\n```python\nfrom RestrictedPython import compile_restricted\nfrom RestrictedPython.Guards import safe_globals, safer_getattr\n\ncalls = []\ndef policy_getattr(obj, name, default=None):\n calls.append(name) # the real guard records every access\n return safer_getattr(obj, name, default)\n\nsrc = \"\"\"\ndef f(o, _getattr_=lambda obj, name: \"shadowed\", /):\n return o.x\n\"\"\"\n\ncode = compile_restricted(src, \"\u003cs\u003e\", \"exec\") # currently compiles, should be rejected\ng = dict(safe_globals)\ng[\"_getattr_\"] = policy_getattr\nexec(code, g)\n\nclass O:\n x = \"secret\"\n\nprint(g[\"f\"](O())) # -\u003e \"shadowed\" (attacker\u0027s local was used)\nprint(calls) # -\u003e [] (policy _getattr_ never ran)\n```\n\n### Patches\n\nThe fix validates positional-only argument names the same way the other argument kinds are already validated. It will ship in the next release.\n\n### Workarounds\n\nNone other than upgrading. If you cannot upgrade immediately, reject any submitted code whose function or lambda definitions use positional-only parameters with leading-underscore names before compiling.",
"id": "GHSA-ffg3-p8fm-mjx2",
"modified": "2026-08-28T22:51:35Z",
"published": "2026-08-28T22:51:35Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-ffg3-p8fm-mjx2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55830"
},
{
"type": "WEB",
"url": "https://github.com/zopefoundation/RestrictedPython/commit/3737596ec9f28c34a073cc845bd2f4c0a80cb671"
},
{
"type": "PACKAGE",
"url": "https://github.com/zopefoundation/RestrictedPython"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "RestrictedPython guard hooks can be shadowed via positional-only arguments"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.