RestrictedPython guard hooks can be shadowed by a positional-only argument, giving full sandbox escape

GitHub Advisory Database·high signalXBlueskyLinkedInCopy link

CVE-2026-55830, published 28 August, breaks RestrictedPython's core mechanism: sandboxed code is rewritten so attribute access goes through _getattr_, item access through _getitem_, writes through _write_ and print through _print_, with the embedding application supplying those hooks. Argument-name validation rejects those protected names for regular arguments, *args, **kwargs and keyword-only arguments, but misses positional-only arguments, so `def f(_getattr_=evil, /)` makes the hook a local and the rewritten access calls the attacker's function instead. Shadowing _print_ additionally captures the internal _getattr_ hook that RestrictedPython passes in, and the result is that sandboxed code escapes the policy entirely.