CVE-2026-55830 Details
Description
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, check_function_argument_names() rejected protected guard hook names for regular, variadic, and keyword-only arguments but omitted positional-only arguments, allowing __getattr__, _getitem_, _write_, or _print_ to be shadowed by a local parameter and bypass the embedding application's access policy. This issue is fixed in version 8.3.
A vulnerability in RestrictedPython prior to version 8.3 allows positional-only function arguments to shadow protected guard hook names, bypassing the embedding application's access policy. The issue arises because the validation function check_function_argument_names() failed to account for positional-only arguments, which can be exploited to manipulate guard hooks used for attribute and item access, writing, and printing. This vulnerability could lead to unauthorized access or actions within the application's sandboxed environment, and in some cases, could be exploited to execute remote code, depending on the application's handling of sandbox-controlled objects.
Users are advised to upgrade to RestrictedPython version 8.3 or later. If an immediate upgrade is not possible, reject any code submissions that use positional-only parameters with leading underscores before compiling.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-ffg3-p8fm-mjx2 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/zopefoundation/RestrictedPython/commit/3737596ec9f28c34a073cc845bd2f4c0a80cb671 | [email protected] | Source CodeVendor |
| https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-ffg3-p8fm-mjx2 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-184 | Incomplete List of Disallowed Inputs | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| RestrictedPython | <= 8.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |