CVE-2026-77401: Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions
Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy restricted AccessControl variants getattr and getitem. This can lead to critical information disclosure.
The AccessControl package already guards against direct access to the formatting functions on string instances, but these mitigations did not cover subclasses of str.
Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it.
Patches A fix was published with version 7.4.
Workarounds There is no workaround.
Other sources
Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In both ImplPython.py and cAccessControl.c, Python formatting can recursively access attributes and subscriptions using unrestricted getattr and getitem behavior instead of the policy-restricted getattr and getitem operations. A controlled format string can therefore disclose objects reachable from values available to the formatting operation. This issue is fixed in version 7.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/AccessControlto a version that resolves this vulnerability.Fixed in 7.4 - Upgrade
Upgrade
Zope AccessControlto a version that resolves this vulnerability.Fixed in 7.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using Zope AccessControl before version 7.4 are affected only if untrusted users can create and execute AccessControl-controlled Python code. The vulnerable behavior is triggered when str.format or str.format_map is reached through a str subclass.
What does an attacker need to exploit this issue?
An attacker needs the ability to supply or control a format string in AccessControl-controlled Python code and have values available to the formatting operation. They can use recursive attribute and subscription access to disclose reachable objects.
What should be done to remediate the issue?
Upgrade Zope AccessControl to version 7.4, which fixes the issue. If upgrading cannot happen immediately, restrict untrusted users from creating or executing AccessControl-controlled Python code and prevent their control of formatting operations involving str subclasses.
How can I assess whether a vulnerable application is at risk?
Review whether the application uses an AccessControl version earlier than 7.4 and permits untrusted users to create and execute controlled Python code. Also identify uses of str.format or str.format_map through str subclasses where user-controlled format strings can access values containing sensitive or otherwise reachable objects.