CVE-2026-55830

RestrictedPython guard hooks can be shadowed via positional-only arguments

from RestrictedPython import compile_restricted
from RestrictedPython.Guards import safe_globals, safer_getattr

calls = []
def policy_getattr(obj, name, default=None):
    calls.append(name)  # the real guard records every access
    return safer_getattr(obj, name, default)

src = """
def f(o, _getattr_=lambda obj, name: "shadowed", /):
    return o.x
"""

code = compile_restricted(src, "<s>", "exec")   # currently compiles, should be rejected
g = dict(safe_globals)
g["_getattr_"] = policy_getattr
exec(code, g)

class O:
    x = "secret"

print(g["f"](O()))   # -> "shadowed"   (attacker's local was used)
print(calls)         # -> []           (policy _getattr_ never ran)

RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes _getattr_(obj, name), item access becomes _getitem_(obj, key), writes go through _write_, and print goes through _print_. The embedding application supplies these hooks to enforce its policy.

Argument-name validation rejects these protected names for regular arguments, *args, **kwargs, and keyword-only arguments, but it misses positional-only arguments (the ones before /). So a function like:

def f(_getattr_=evil, /):
    return o.x

makes _getattr_ a local that shadows the policy hook, and the rewritten access calls evil instead. The same works for _getitem_, _write_, and _print_. Shadowing _print_ can also be used to capture the internal _getattr_ hook that RestrictedPython passes in.

The result is that sandboxed code can bypass the access policy the embedding application relies on. In applications that also handle sandbox-controlled objects unsafely (for example serializing them with pickle), this primitive can be chained further, up to remote code execution. That part depends on the embedding application, but the underlying guard bypass is in RestrictedPython.

CVE-2026-55830 has a CVSS score of 8.3 (High). The vector is network-reachable, high privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (8.3); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

The fix validates positional-only argument names the same way the other argument kinds are already validated. It will ship in the next release.

1. What is CVE-2026-55830? CVE-2026-55830 is a high-severity security vulnerability in RestrictedPython (pip), affecting versions <= 8.2. It is fixed in 8.3.
2. How severe is CVE-2026-55830? CVE-2026-55830 has a CVSS score of 8.3 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of RestrictedPython are affected by CVE-2026-55830? RestrictedPython (pip) versions <= 8.2 is affected.
4. Is there a fix for CVE-2026-55830? Yes. CVE-2026-55830 is fixed in 8.3. Upgrade to this version or later.
5. Is CVE-2026-55830 exploitable, and should I be worried? Whether CVE-2026-55830 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-55830 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-55830? Upgrade RestrictedPython to 8.3 or later.

Other vulnerabilities in RestrictedPython