https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 00:15:09 +0000 https://vulnerability.circl.lu/vuln/cleanstart-2026-oy92874 <p><strong>Affected:</strong> CleanStart: litellm-database</p> <p>Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: litellm-database</p> <p>Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details.</p> https://vulnerability.circl.lu/vuln/cleanstart-2026-oy92874 https://vulnerability.circl.lu/vuln/fkie_cve-2026-55830 <p>RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, check_function_argument_names() rejected protected guard hook names for regular, variadic, and keyword-only arguments but omitted positional-only arguments, allowing __getattr__, _getitem_, _write_, or _print_ to be shadowed by a local parameter and bypass the embedding application&#39;s access policy. This issue is fixed in version 8.3.</p> <p>RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, check_function_argument_names() rejected protected guard hook names for regular, variadic, and keyword-only arguments but omitted positional-only arguments, allowing __getattr__, _getitem_, _write_, or _print_ to be shadowed by a local parameter and bypass the embedding application&#39;s access policy. This issue is fixed in version 8.3.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-55830 https://vulnerability.circl.lu/vuln/ghsa-ffg3-p8fm-mjx2 <p><strong>Affected:</strong> PyPI: RestrictedPython</p> <p>### Impact</p> <p>RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes `_getattr_(obj, name)`, item access becomes `_getitem_(obj, key)`, writes go through `_write_`, and print goes through `_print_`. The embedding application supplies these hooks to enforce its policy.</p> <p>Argument-name validation rejects these protected names for regular arguments, `*args`, `**kwargs`, and keyword-only arguments, but it misses positional-only arguments (the ones before `/`). So a function like:</p> <p>```python def f(_getattr_=evil, /): return o.x ```</p> <p>makes `_getattr_` a local that shadows the policy hook, and the rewritten access calls `evil` instead. The same works for `_getitem_`, `_write_`, and `_print_`. Shadowing `_print_` can also be used to capture the internal `_getattr_` hook that RestrictedPython passes in.</p> <p>The result is that sandboxed code can bypass the access policy the embedding application relies on. In applications that also handle sandbox-controlled objects unsafely (for example serializing them with pickle), this primitive can be chained further, up to remote code execution. That part depends on the embedding application, but the underlying guard bypass is in RestrictedPython.</p> <p>### Proof of concept</p> <p>On an unpatched RestrictedPython this prints `shadowed` and an empty `calls` list, meaning the policy `_getattr_` never ran. With the fix, `compile_restricted` rejects the code.</p> <p>```python from RestrictedPython import compile_restricted fr…</p> <p><strong>Affected:</strong> PyPI: RestrictedPython</p> <p>### Impact</p> <p>RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes `_getattr_(obj, name)`, item access becomes `_getitem_(obj, key)`, writes go through `_write_`, and print goes through `_print_`. The embedding application supplies these hooks to enforce its policy.</p> <p>Argument-name validation rejects these protected names for regular arguments, `*args`, `**kwargs`, and keyword-only arguments, but it misses positional-only arguments (the ones before `/`). So a function like:</p> <p>```python def f(_getattr_=evil, /): return o.x ```</p> <p>makes `_getattr_` a local that shadows the policy hook, and the rewritten access calls `evil` instead. The same works for `_getitem_`, `_write_`, and `_print_`. Shadowing `_print_` can also be used to capture the internal `_getattr_` hook that RestrictedPython passes in.</p> <p>The result is that sandboxed code can bypass the access policy the embedding application relies on. In applications that also handle sandbox-controlled objects unsafely (for example serializing them with pickle), this primitive can be chained further, up to remote code execution. That part depends on the embedding application, but the underlying guard bypass is in RestrictedPython.</p> <p>### Proof of concept</p> <p>On an unpatched RestrictedPython this prints `shadowed` and an empty `calls` list, meaning the policy `_getattr_` never ran. With the fix, `compile_restricted` rejects the code.</p> <p>```python from RestrictedPython import compile_restricted fr…</p> https://vulnerability.circl.lu/vuln/ghsa-ffg3-p8fm-mjx2 https://vulnerability.circl.lu/vuln/pysec-2026-3917 <p><strong>Affected:</strong> PyPI: restrictedpython</p> <p>### Impact</p> <p>RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes `_getattr_(obj, name)`, item access becomes `_getitem_(obj, key)`, writes go through `_write_`, and print goes through `_print_`. The embedding application supplies these hooks to enforce its policy.</p> <p>Argument-name validation rejects these protected names for regular arguments, `*args`, `**kwargs`, and keyword-only arguments, but it misses positional-only arguments (the ones before `/`). So a function like:</p> <p>```python def f(_getattr_=evil, /): return o.x ```</p> <p>makes `_getattr_` a local that shadows the policy hook, and the rewritten access calls `evil` instead. The same works for `_getitem_`, `_write_`, and `_print_`. Shadowing `_print_` can also be used to capture the internal `_getattr_` hook that RestrictedPython passes in.</p> <p>The result is that sandboxed code can bypass the access policy the embedding application relies on. In applications that also handle sandbox-controlled objects unsafely (for example serializing them with pickle), this primitive can be chained further, up to remote code execution. That part depends on the embedding application, but the underlying guard bypass is in RestrictedPython.</p> <p>### Proof of concept</p> <p>On an unpatched RestrictedPython this prints `shadowed` and an empty `calls` list, meaning the policy `_getattr_` never ran. With the fix, `compile_restricted` rejects the code.</p> <p>```python from RestrictedPython import compile_restricted fr…</p> <p><strong>Affected:</strong> PyPI: restrictedpython</p> <p>### Impact</p> <p>RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes `_getattr_(obj, name)`, item access becomes `_getitem_(obj, key)`, writes go through `_write_`, and print goes through `_print_`. The embedding application supplies these hooks to enforce its policy.</p> <p>Argument-name validation rejects these protected names for regular arguments, `*args`, `**kwargs`, and keyword-only arguments, but it misses positional-only arguments (the ones before `/`). So a function like:</p> <p>```python def f(_getattr_=evil, /): return o.x ```</p> <p>makes `_getattr_` a local that shadows the policy hook, and the rewritten access calls `evil` instead. The same works for `_getitem_`, `_write_`, and `_print_`. Shadowing `_print_` can also be used to capture the internal `_getattr_` hook that RestrictedPython passes in.</p> <p>The result is that sandboxed code can bypass the access policy the embedding application relies on. In applications that also handle sandbox-controlled objects unsafely (for example serializing them with pickle), this primitive can be chained further, up to remote code execution. That part depends on the embedding application, but the underlying guard bypass is in RestrictedPython.</p> <p>### Proof of concept</p> <p>On an unpatched RestrictedPython this prints `shadowed` and an empty `calls` list, meaning the policy `_getattr_` never ran. With the fix, `compile_restricted` rejects the code.</p> <p>```python from RestrictedPython import compile_restricted fr…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3917 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-55830 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: restrictedpython, Ubuntu:18.04:LTS: restrictedpython, Ubuntu:Pro:20.04:LTS: restrictedpython, Ubuntu:Pro:22.04:LTS: restrictedpython, Ubuntu:Pro:24.04:LTS: restrictedpython, Ubuntu:26.04:LTS: restrictedpython</p> <p>RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, check_function_argument_names() rejected protected guard hook names for regular, variadic, and keyword-only arguments but omitted positional-only arguments, allowing __getattr__, _getitem_, _write_, or _print_ to be shadowed by a local parameter and bypass the embedding application&#39;s access policy. This issue is fixed in version 8.3.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: restrictedpython, Ubuntu:18.04:LTS: restrictedpython, Ubuntu:Pro:20.04:LTS: restrictedpython, Ubuntu:Pro:22.04:LTS: restrictedpython, Ubuntu:Pro:24.04:LTS: restrictedpython, Ubuntu:26.04:LTS: restrictedpython</p> <p>RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, check_function_argument_names() rejected protected guard hook names for regular, variadic, and keyword-only arguments but omitted positional-only arguments, allowing __getattr__, _getitem_, _write_, or _print_ to be shadowed by a local parameter and bypass the embedding application&#39;s access policy. This issue is fixed in version 8.3.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-55830