CVE-2025-22153: RestrictedPython Auth Bypass Vulnerability

CVE-2025-22153 Overview

CVE-2025-22153 is a sandbox escape vulnerability in RestrictedPython, a tool that defines a subset of Python for executing untrusted code in trusted environments. The flaw stems from a type confusion bug ([CWE-843]) in the CPython interpreter between versions 3.11 and 3.13.2 when handling try/except* clauses. Attackers with the ability to submit code into a RestrictedPython sandbox can bypass restrictions and escape the trusted environment. The issue affects RestrictedPython versions 6.0 through 7.x and is patched in version 8.0 by removing support for try/except* clauses entirely.

Critical Impact
Successful exploitation allows attackers to bypass the RestrictedPython sandbox, leading to confidentiality and integrity compromise of the host process running untrusted Python code.

Affected Products

RestrictedPython versions 6.0 through 7.x (fixed in 8.0)
CPython interpreter 3.11 through 3.13.1 when used with vulnerable RestrictedPython versions
Zope and Plone deployments leveraging RestrictedPython for untrusted script execution

Discovery Timeline

2025-01-23 - CVE-2025-22153 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-22153

Vulnerability Analysis

RestrictedPython compiles and rewrites Python source code to enforce sandbox restrictions, blocking access to dangerous attributes and built-ins. The vulnerability arises because RestrictedPython introduced support for the try/except* exception group syntax in version 6.0 to align with Python 3.11. However, a type confusion bug in the CPython interpreter's handling of try/except* clauses allows code executed inside the sandbox to manipulate exception objects in ways that bypass the restriction layer. An attacker who can submit Python source to a RestrictedPython environment can craft an except* block that escapes sandbox controls and executes arbitrary operations in the host interpreter context.

Root Cause

The root cause is a type confusion flaw ([CWE-843]) in CPython 3.11 through 3.13.1 when processing try/except* syntax. RestrictedPython's AST rewriting does not anticipate the interpreter-level confusion, so its security transforms are insufficient when this construct is present. The maintainers determined that try/except* provides little value inside a sandbox and removed support entirely rather than attempt a partial mitigation.

Attack Vector

Exploitation requires the attacker to supply Python source code to an application that compiles and executes it through RestrictedPython. This is the standard use case for products such as Zope and Plone, where authenticated users with elevated privileges can author through-the-web scripts. The high attack complexity and required privileges reflect that exploitation depends on access to a code-submission interface backed by a vulnerable RestrictedPython version.

text

 Changes
 =======

-7.5 (unreleased)
+8.0 (unreleased)
 ----------------

+Backwards incompatible changes
+++++++++++++++++++++++++++++++
+
+- Disallow ``try/except*`` clauses due to a possible sandbox escape and
+  probable uselessness of this feature in the context of ``RestrictedPython``.
+  In addition, remove ``ExceptionGroup`` from ``safe_builtins`` (as useful only
+  with ``try/except*``). - This feature was introduced into
+  ``RestrictedPython`` in version 6.0 for Python 3.11+. (CVE-2025-22153)

Source: GitHub Commit 48a92c5. The patch removes try/except* parsing support and drops ExceptionGroup from safe_builtins.

Detection Methods for CVE-2025-22153

Indicators of Compromise

Untrusted Python scripts submitted to a RestrictedPython environment containing try statements with except* clauses
References to ExceptionGroup or BaseExceptionGroup builtins inside user-supplied scripts
Unexpected child processes, file writes, or network egress originating from a Zope, Plone, or other RestrictedPython-hosting process

Detection Strategies

Inventory RestrictedPython package versions across application servers and flag any installation between 6.0 and 7.x running on CPython 3.11 through 3.13.1
Statically scan stored user scripts and through-the-web content for the except* token before they are compiled
Enable Python audit hooks (sys.addaudithook) to log subprocess, file, and import events triggered by the embedded interpreter

Monitoring Recommendations

Forward application and interpreter logs to a centralized analytics platform and alert on anomalous syscalls from RestrictedPython worker processes
Monitor authenticated user activity on script-authoring endpoints in Zope and Plone for sudden volume increases
Track outbound connections from web application accounts that should be confined to template rendering

How to Mitigate CVE-2025-22153

Immediate Actions Required

Upgrade RestrictedPython to version 8.0 or later on all hosts that compile untrusted Python
Audit existing user-supplied scripts for try/except* constructs and remove or reject them before execution
Restrict script-authoring permissions to trusted administrators until the upgrade is deployed

Patch Information

RestrictedPython 8.0 contains the fix and was released alongside commit 48a92c5bb617a647cffd0dadd4d5cfe626bcdb2f. The patch disallows try/except* clauses during AST transformation and removes ExceptionGroup from safe_builtins. Full details are available in the GitHub Security Advisory GHSA-gmj9-h825-chq2.

Workarounds

No official workarounds are documented by the maintainers; upgrading to 8.0 is the supported remediation
As a temporary control, reject any submitted source code containing the except* token before passing it to RestrictedPython
Limit access to interfaces that accept Python code from untrusted or low-privilege users

bash

# Upgrade RestrictedPython to the patched release
pip install --upgrade 'RestrictedPython>=8.0'

# Verify the installed version
python -c "import RestrictedPython; print(RestrictedPython.__version__)"