RestrictedPython

RestrictedPython versions prior to 8.4 are vulnerable to a sandbox escape (CVE-2026-76825) via the string.Formatter module, which can bypass attribute guards to access sensitive objects and primitives.

RestrictedPython (<= 8.2) fails to validate positional-only arguments, allowing an attacker to shadow security guard hooks (_getattr_, _getitem_, _write_, _print_) and bypass sandbox access policies.