CVE-2026-55830

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55830

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55830.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55830

Aliases

GHSA-ffg3-p8fm-mjx2

Published

2026-07-08T21:16:36.200Z

Modified

2026-08-12T03:51:49.450427019Z

Severity

8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L CVSS Calculator

Summary

RestrictedPython guard hooks can be shadowed via positional-only arguments

Details

RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, checkfunctionargument_names() rejected protected guard hook names for regular, variadic, and keyword-only arguments but omitted positional-only arguments, allowing getattr, getitem, write, or print to be shadowed by a local parameter and bypass the embedding application's access policy. This issue is fixed in version 8.3.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55830.json",
    "cwe_ids": [
        "CWE-184"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/zopefoundation/restrictedpython

Affected ranges

Type

GIT

Repo

https://github.com/zopefoundation/restrictedpython

Events

Introduced

Fixed

3737596ec9f28c34a073cc845bd2f4c0a80cb671

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.3"
        }
    ]
}

Affected versions

4.*

4.0

4.0a1

4.0a2

4.0a3

4.0b1

4.0b2

4.0b3

4.0b4

4.0b5

4.0b6

4.0b7

4.0b8

5.*

5.0

5.1

5.2

5.2a1.dev0

5.3a1.dev0

6.*

6.0

6.0a1.dev0

7.*

7.0

7.0a1.dev0

7.0a1.dev1

7.0a2.dev0

7.1

7.2

7.2a1.dev0

7.3

7.4

8.*

8.0

8.1

8.1a1.dev0

8.2

8.3a1.dev0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55830.json"