CVE-2026-76825 in RestrictedPython
Summary
by MITRE • 09/16/2026
RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPython could allow a sandbox escape when a custom import policy or globals exposed the standard library string module, the string.Formatter class, a Formatter instance, or a Formatter subclass to restricted code. The string.Formatter methods format, get_field, get_value, and vformat performed attribute and item traversal internally without passing through RestrictedPython's safer_getattr protections. Restricted code could use those live object references to reach function globals, builtins, file access, or code execution primitives, affecting confidentiality, integrity, and availability in the host environment. This issue is fixed in version 8.4.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
RestrictedPython serves as a critical security mechanism for environments where untrusted Python code must be executed within a controlled sandbox. Its primary function is to restrict access to dangerous built-ins and attributes, thereby preventing malicious actors from escaping the execution context to compromise the host system. However, prior to version 8.4, this library contained a significant architectural flaw that allowed attackers to bypass these restrictions through specific interactions with Python's string formatting infrastructure. The vulnerability arises when custom import policies or global variables expose standard library components such as the string module, the string.Formatter class, instances of Formatter, or subclasses thereof to the restricted execution environment. This exposure creates an attack surface where the internal mechanisms of the formatter can be leveraged to circumvent RestrictedPython's protective layers.
The core technical flaw lies in how certain methods within the string.Formatter class operate during attribute and item traversal. Specifically, the format, get_field, get_value, and vformat methods perform these traversals internally without routing through RestrictedPython's safer_getattr protections. In a properly secured environment, all attribute access should be intercepted by restricted handlers that validate permissions before allowing retrieval. Because these formatter methods bypass this interception mechanism, they effectively act as an indirect execution path or proxy. An attacker can exploit this gap to traverse object hierarchies in ways that are normally prohibited, reaching into function globals and accessing built-in objects that would otherwise remain inaccessible within the sandbox.
This capability allows for a severe sandbox escape with profound implications for system security. By leveraging these internal formatter methods, restricted code can gain access to sensitive data stored in global variables, read from or write to files on the host filesystem, and ultimately execute arbitrary code primitives. The impact extends across all three pillars of information security: confidentiality is compromised as attackers can exfiltrate private data; integrity is undermined because system state can be altered through file manipulation or variable modification; and availability is threatened if the attacker chooses to disrupt services by consuming resources or crashing processes via uncontrolled execution paths. This vulnerability effectively nullifies the protective boundaries intended by RestrictedPython, rendering it unsafe for processing user-supplied input in trusted environments unless specific mitigations are applied.
To mitigate this risk, organizations must immediately upgrade to version 8.4 of RestrictedPython, which addresses these traversal flaws and ensures that attribute access is consistently protected regardless of the entry point used within the standard library. For systems unable to update promptly, it is imperative to ensure that no instances of string.Formatter or related classes are exposed in the global namespace available to restricted code. Additionally, custom import policies should be audited to prevent the loading of these specific modules into the sandboxed environment. This incident highlights the importance of rigorous validation for all attribute access mechanisms within security libraries and aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command regarding indirect command execution risks, as well as ATT&CK technique T1059 Command and Scripting Interpreter where Python is utilized to execute unauthorized commands.