{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/restrictedpython--8.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:restrictedpython:restrictedpython:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-55830"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["RestrictedPython (\u003c= 8.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["RestrictedPython"],"content_html":"\u003cp\u003eThe RestrictedPython library utilizes specific guard hooks (such as \u003ccode\u003e_getattr_\u003c/code\u003e, \u003ccode\u003e_getitem_\u003c/code\u003e, \u003ccode\u003e_write_\u003c/code\u003e, and \u003ccode\u003e_print_\u003c/code\u003e) to rewrite and enforce security policies for sandboxed Python code. While the library correctly validates these protected names against standard function arguments, \u003ccode\u003e*args\u003c/code\u003e, \u003ccode\u003e**kwargs\u003c/code\u003e, and keyword-only arguments, it fails to perform the same checks for positional-only arguments defined before the \u003ccode\u003e/\u003c/code\u003e separator in a function signature.\u003c/p\u003e\n\u003cp\u003eThis vulnerability allows an attacker to define a function with one of the restricted guard names as a positional-only argument. This effectively localizes the name, causing the Python interpreter to shadow the embedding application's intended security hook. When the sandboxed code executes, it invokes the attacker's defined function instead of the policy-enforcing hook. Depending on the broader application context, this bypass can be escalated into remote code execution, particularly if the application performs unsafe operations like unpickling objects controlled by the sandboxed environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for complete bypass of sandboxed environment restrictions. In scenarios where the host application relies on RestrictedPython to safely execute user-provided code, attackers can access forbidden system attributes, modify protected data, or exfiltrate information. In applications that perform insecure operations on sandbox-controlled objects, such as serialization or deserialization, this primitive can lead to remote code execution (RCE). The impact is highly dependent on how the embedding application utilizes the library.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for development and security operations teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade RestrictedPython to the version containing the security patch as soon as it is released (addressing CVE-2026-55830).\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not possible, implement a static analysis check in the ingestion pipeline to reject any Python source code that uses positional-only parameters containing leading underscores (e.g., \u003ccode\u003edef f(_getattr_=..., /):\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eReview application code that utilizes RestrictedPython to ensure that objects returned from or manipulated by the sandbox are handled using secure, non-executable serialization methods (e.g., avoiding pickle).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-29T03:13:27Z","date_published":"2026-08-29T03:13:27Z","id":"https://feed.craftedsignal.io/briefs/2026-08-restrictedpython-bypass/","summary":"RestrictedPython (\u003c= 8.2) fails to validate positional-only arguments, allowing an attacker to shadow security guard hooks (_getattr_, _getitem_, _write_, _print_) and bypass sandbox access policies.","title":"RestrictedPython Positional-Only Argument Guard Bypass","url":"https://feed.craftedsignal.io/briefs/2026-08-restrictedpython-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - RestrictedPython (\u003c= 8.2)","version":"https://jsonfeed.org/version/1.1"}