CVE-2026-76825: RestrictedPython: Sandbox escape via string.Formatter field resolution
Impact RestrictedPython could allow a sandbox escape when a policy exposes the standard library string module, or otherwise exposes string.Formatter, to restricted code.
string.Formatter field resolution methods such as getfield can perform attribute and item traversal internally and return live object references. This can bypass RestrictedPython's normal attribute guards and may allow access to sensitive objects such as function globals, builtins, file access, or code execution primitives.
Users are impacted if they run untrusted code with RestrictedPython and expose string.Formatter, directly or indirectly, for example through a custom import policy or globals.
Patches The problem has been patched by blocking access to string.Formatter and unsafe string.Formatter traversal methods in safergetattr.
Users should upgrade to the patched release once available. Affected and patched version numbers should be filled in when the release is published.
Workarounds Do not expose the standard library string module or string.Formatter to restricted code.
If a custom import hook is used, deny imports of string or provide only a restricted wrapper that does not expose Formatter. If custom globals are supplied, ensure neither string.Formatter nor Formatter instances are available to restricted code.
Other sources
RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPython could allow a sandbox escape when a custom import policy or globals exposed the standard library string module, the string.Formatter class, a Formatter instance, or a Formatter subclass to restricted code. The string.Formatter methods format, getfield, getvalue, and vformat performed attribute and item traversal internally without passing through RestrictedPython's safergetattr protections. Restricted code could use those live object references to reach function globals, builtins, file access, or code execution primitives, affecting confidentiality, integrity, and availability in the host environment. This issue is fixed in version 8.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/RestrictedPythonto a version that resolves this vulnerability.Fixed in 8.4 - Upgrade
Upgrade
RestrictedPythonto a version that resolves this vulnerability.Fixed in 8.4 - Configuration
Do not expose the standard library `string` module or `string.Formatter` (or `Formatter` instances/subclasses) to restricted code via a custom import hook or custom globals. Ensure restricted code cannot access `string.Formatter` or `Formatter` objects.
RestrictedPython sandbox import policy / globals access_to_string.Formatter = deny - Configuration
If a custom import hook is used, deny imports of `string` or provide only a restricted wrapper that does not expose `Formatter` (i.e., `string.Formatter`).
RestrictedPython custom import hook deny_imports = string - Configuration
If custom globals are supplied, ensure neither `string.Formatter` nor `Formatter` instances are available to restricted code.
RestrictedPython custom globals Formatter availability = not_available_to_restricted_code - Compensating control
Until patched, use RestrictedPython only in a trusted setup where `string.Formatter`/`Formatter` are not exposed through any custom import policy or custom globals, to prevent sandbox escape via `Formatter` field resolution methods (e.g., `get_field`, `get_value`, `vformat`).
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using RestrictedPython before version 8.4 are exposed if restricted code can access the standard-library string module, string.Formatter, a Formatter instance, or a Formatter subclass through custom import policy or supplied globals. The issue is not described as affecting configurations that do not expose any of those objects to restricted code.
What does an attacker need to exploit it?
An attacker needs the ability to submit or run restricted Python code and access to a live string.Formatter-related object through the sandbox's imports or globals. They can then abuse Formatter's internal attribute and item traversal, which bypasses RestrictedPython's safer_getattr protections.
What could successful exploitation allow?
Restricted code may escape the sandbox and reach function globals, builtins, file-access capabilities, or code-execution primitives in the host environment. This can affect confidentiality, integrity, and availability.
What should be done if an immediate upgrade is not possible?
Prevent restricted code from accessing the string module, string.Formatter, Formatter instances, and Formatter subclasses through custom import policies or supplied globals. This removes the object references identified as the path to exploitation until version 8.4 can be deployed.