CVE-2026-55830: CWE-184: Incomplete List of Disallowed Inputs in zopefoundation RestrictedPython
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, check_function_argument_names() rejected protected guard hook names for regular, variadic, and keyword-only arguments but omitted positional-only arguments, allowing __getattr__, _getitem_, _write_, or _print_ to be shadowed by a local parameter and bypass the embedding application's access policy. This issue is fixed in version 8.3.
AI Analysis
Technical Summary
The vulnerability in zopefoundation's RestrictedPython involves an incomplete list of disallowed inputs in the function check_function_argument_names(). While regular, variadic, and keyword-only arguments are checked to reject protected guard hook names, positional-only arguments were omitted from this validation prior to version 8.3. This flaw allows an attacker to shadow critical guard hook names with local parameters, thereby bypassing access controls enforced by the embedding application. The vulnerability is identified as CWE-184 (Incomplete Control of a Resource Through its Lifetime) and has a CVSS 3.1 base score of 8.3, indicating high severity. The issue is fixed in RestrictedPython version 8.3.
Potential Impact
Exploitation of this vulnerability could allow an attacker with high privileges and user interaction to bypass access policies in applications embedding RestrictedPython by shadowing protected guard hook names with positional-only parameters. This can lead to complete compromise of confidentiality and integrity, with limited impact on availability.
Mitigation Recommendations
Upgrade to RestrictedPython version 8.3 or later, where the vulnerability is fixed. Patch status is confirmed by the vendor advisory indicating the issue is resolved in version 8.3. No additional mitigations are specified.
CVE-2026-55830: CWE-184: Incomplete List of Disallowed Inputs in zopefoundation RestrictedPython
Description
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, check_function_argument_names() rejected protected guard hook names for regular, variadic, and keyword-only arguments but omitted positional-only arguments, allowing __getattr__, _getitem_, _write_, or _print_ to be shadowed by a local parameter and bypass the embedding application's access policy. This issue is fixed in version 8.3.
CVSS v3.1
Score 8.3high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in zopefoundation's RestrictedPython involves an incomplete list of disallowed inputs in the function check_function_argument_names(). While regular, variadic, and keyword-only arguments are checked to reject protected guard hook names, positional-only arguments were omitted from this validation prior to version 8.3. This flaw allows an attacker to shadow critical guard hook names with local parameters, thereby bypassing access controls enforced by the embedding application. The vulnerability is identified as CWE-184 (Incomplete Control of a Resource Through its Lifetime) and has a CVSS 3.1 base score of 8.3, indicating high severity. The issue is fixed in RestrictedPython version 8.3.
Potential Impact
Exploitation of this vulnerability could allow an attacker with high privileges and user interaction to bypass access policies in applications embedding RestrictedPython by shadowing protected guard hook names with positional-only parameters. This can lead to complete compromise of confidentiality and integrity, with limited impact on availability.
Mitigation Recommendations
Upgrade to RestrictedPython version 8.3 or later, where the vulnerability is fixed. Patch status is confirmed by the vendor advisory indicating the issue is resolved in version 8.3. No additional mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-17T16:29:38.864Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4ec4a5c9d9e3dbe3c8d493
Added to database: 07/08/2026, 21:44:05 UTC
Last enriched: 07/16/2026, 10:11:46 UTC
Last updated: 08/21/2026, 22:52:13 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.