Executive brief
RestrictedPython is a Python library used to safely execute untrusted code in a restricted sandbox environment. An attacker can bypass RestrictedPython's security controls by exploiting how the standard library's `string.Formatter` class traverses object attributes and items, potentially gaining access to sensitive objects like function globals, built-in functions, and file system or code execution primitives. This vulnerability only affects systems that expose the `string` module or `string.Formatter` to untrusted code, whether directly or through custom import policies.
Technical details
The vulnerability exists in RestrictedPython's attribute access guard mechanism. The `string.Formatter` class's field resolution methods (e.g., `get_field`) perform internal attribute and item traversal to resolve format string placeholders, and these traversals can return live object references that bypass RestrictedPython's `safer_getattr` guards. An attacker with the ability to execute code in the restricted environment can craft format strings that traverse the object graph to reach sensitive objects. The attack requires network access to the RestrictedPython execution environment and admin privileges to set up the restricted code execution context. The vulnerability has been patched in version 8.4 by blocking access to `string.Formatter` and its unsafe traversal methods in `safer_getattr`. Users running untrusted code should upgrade immediately and, as a workaround, should not expose the `string` module or `Formatter` instances to restricted code.
Affected products
- Zope Foundation RestrictedPython < 8.4
Timeline
- 2026-09-17: disclosed: GitHub Advisory GHSA-hp3v-5vw7-fx9w published
- 2026-09-17: patched: Version 8.4 released with patch blocking string.Formatter access