RestrictedPython Sandbox Escape via string.Formatter

RestrictedPython, a package designed to provide a sandbox environment for executing untrusted Python code, contains a vulnerability identified as CVE-2026-76825. This vulnerability allows for a sandbox escape if an application policy exposes the standard library 'string' module or the 'string.Formatter' class to the restricted environment.

The issue stems from how 'string.Formatter' performs field resolution. Specifically, internal methods such as 'get_field' can perform attribute and item traversal that bypasses RestrictedPython's established attribute guards. By leveraging this behavior, an attacker capable of executing code within the restricted environment can obtain references to sensitive objects. These objects may include function globals, builtins, and code execution primitives, potentially enabling the attacker to break out of the sandbox to perform arbitrary operations on the underlying host system. This vulnerability affects all versions of RestrictedPython prior to 8.4.

Impact

The vulnerability poses a severe risk to any application relying on RestrictedPython to safely execute untrusted user-supplied code. If successfully exploited, an attacker could escalate privileges from the restricted sandbox to the host environment, leading to full application compromise, unauthorized data access, or arbitrary code execution. The scope of impact is dependent on the application's configuration and the level of access granted to the 'string' module within its restricted environment.

Recommendation

Prioritized actions for development and security teams:

• Upgrade the 'RestrictedPython' package to version 8.4 or later immediately to apply the fix in 'safer_getattr'.
• Review custom import policies to ensure the 'string' module and 'string.Formatter' class are not exposed to restricted execution environments.
• Audit custom global configurations passed to RestrictedPython to ensure neither 'string.Formatter' nor instances of it are accessible to untrusted code.
• Implement a policy of least privilege by restricting access to standard library modules within the Python sandbox environment.