CVE-2026-55830: RestrictedPython guard hooks can be shadowed via positional-only arguments
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, checkfunctionargumentnames() rejected protected guard hook names for regular, variadic, and keyword-only arguments but omitted positional-only arguments, allowing getattr, getitem, write, or print to be shadowed by a local parameter and bypass the embedding application's access policy. This issue is fixed in version 8.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55830?
CVE-2026-55830 has a severity rating of 8.3, categorized as high risk.
How do I fix CVE-2026-55830?
To fix CVE-2026-55830, upgrade to version 8.3 or later of RestrictedPython.
What are the potential impacts of CVE-2026-55830?
CVE-2026-55830 may allow unauthorized access to protected guard hook names, which poses a security risk.
What software is affected by CVE-2026-55830?
CVE-2026-55830 affects the RestrictedPython library.
When was CVE-2026-55830 published?
CVE-2026-55830 was published on July 8, 2026.