Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-29 · source-backed
CVE-2026-55830 breaks the mechanism the whole library rests on. Sandboxed code is rewritten so attribute access goes through _getattr_, item access through _getitem_, writes through _write_. Argument-name validation rejects those protected names for regular args, *args, **kwargs and keyword-only args, and misses positional-only. So def f(_getattr_=evil, /) makes the hook a local, and every rewritten access calls the attacker's function. Shadowing _print_ additionally captures the internal _getattr_ hook RestrictedPython passes in. Full policy escape from a syntax feature the validator forgot existed. (GitHub Advisory)
Each link below shares sources, entities, or timing with this story.
Shared entities / Same source domain / Earlier coverage / Tension
Both cover CVE, GHSA, GitHub Advisory; reported by the same outlet (github.com); earlier CVE coverage from 2026-08-27.
Shared entities / Same source domain / Shared topic
Both cover CVE, GHSA, GitHub Advisory; reported by the same outlet (github.com); overlapping topics (access, attacker).
Shared entities / Same source domain / Shared topic / Earlier coverage / Tension
Both cover CVE, GHSA; reported by the same outlet (github.com); overlapping topics (attacker, call).
Shared entities / Same source domain / Earlier coverage
Both cover CVE, GHSA, GitHub Advisory; reported by the same outlet (github.com); earlier CVE coverage from 2026-02-27.
Shared entities / Same source domain / Shared topic / Earlier coverage
Both cover CVE, GHSA; reported by the same outlet (github.com); overlapping topics (attacker, call).
Both cover CVE, GHSA; reported by the same outlet (github.com); overlapping topics (attacker, break).
Shared entities / Same source domain
Both cover CVE, GHSA, GitHub Advisory; reported by the same outlet (github.com).
Shared entities / Same source domain / Earlier coverage / Tension
Both cover GHSA, GitHub Advisory; reported by the same outlet (github.com); earlier GHSA coverage from 2026-08-27.