A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj
and the string
module.
The problem will be fixed in version 7.3.
If the application does not require access to the module string
, it can remove it from RestrictedPython.Utilities.utility_builtins
or otherwise do not make it available in the restricted execution environment.