CVE-2026-76825: RestrictedPython Sandbox Escape RCE Vulnerability

CVE-2026-76825 Overview

CVE-2026-76825 is a sandbox escape vulnerability in RestrictedPython, a library that defines a subset of Python for executing untrusted code in trusted environments. Versions prior to 8.4 fail to protect access to the standard library string.Formatter class when custom import policies or globals expose it to restricted code. The format, get_field, get_value, and vformat methods perform attribute and item traversal internally, bypassing the safer_getattr protections that RestrictedPython relies on for isolation. Attackers with the ability to submit restricted code can reach function globals, builtins, file access, and code execution primitives on the host.

Critical Impact
Restricted code can escape the RestrictedPython sandbox and compromise confidentiality, integrity, and availability of the host environment.

Affected Products

RestrictedPython versions prior to 8.4
Applications using RestrictedPython with import policies or globals exposing the string module
Applications exposing string.Formatter, Formatter instances, or Formatter subclasses to restricted code

Discovery Timeline

2026-09-16 - CVE-2026-76825 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-76825

Vulnerability Analysis

RestrictedPython enforces sandbox boundaries by rewriting attribute access to route through safer_getattr, which blocks access to dunder attributes and sensitive object internals. The string.Formatter class in the Python standard library performs its own attribute and item traversal in native code paths inside format, get_field, get_value, and vformat. These traversals never invoke safer_getattr, so restricted code that reaches a Formatter instance can pivot through live object references to reach __globals__, __builtins__, and file or code execution primitives. The weakness is classified as [CWE-200] information exposure, though the practical outcome is arbitrary code execution in the host process.

Root Cause

The root cause is a missing guard in RestrictedPython/Guards.py. The library did not treat string.Formatter as a restricted attribute, so any environment that exposed the string module through a custom import policy or a permissive globals dictionary handed restricted code a traversal primitive that operated outside sandbox controls.

Attack Vector

Exploitation requires an attacker to supply Python source that RestrictedPython compiles and executes. The attacker must also operate in a deployment that exposes the string module, a Formatter class, or a Formatter instance to the restricted globals. Once reached, format string traversal walks arbitrary attribute chains from any accessible object, allowing the attacker to reach function __globals__ and Python builtins to execute arbitrary code with the privileges of the host process.

text

# Patch note from CHANGES.rst
- Disallow mode="function" in compile_restricted (it never worked).

+ Prevent access to string.Formatter and its unsafe traversal methods via
+ safer_getattr.

8.3 (2026-06-16)

Source: GitHub Commit 3b47440

python

# Guards.py import additions
import builtins
import string

from RestrictedPython.transformer import INSPECT_ATTRIBUTES

Source: GitHub Commit 3b47440. The fix imports the string module into Guards.py so safer_getattr can identify and block Formatter attribute access.

Detection Methods for CVE-2026-76825

Indicators of Compromise

Restricted code submissions containing references to string.Formatter, format, vformat, get_field, or get_value
Format strings containing attribute traversal syntax such as {0.__class__.__mro__} or {0.__globals__}
Unexpected child processes or file system access originating from Python interpreters hosting RestrictedPython workloads

Detection Strategies

Perform static analysis on user-submitted scripts to flag imports of string and references to Formatter classes or instances
Inventory RestrictedPython deployments and confirm which globals and import policies expose standard library modules to restricted code
Monitor process behavior of host services running RestrictedPython for anomalous execution, network egress, or file access from sandboxed contexts

Monitoring Recommendations

Log all RestrictedPython compilation events and correlate submitted source with subsequent process telemetry
Alert on Python processes spawning shells, invoking os or subprocess primitives, or reading credential files after executing restricted code
Track installed RestrictedPython versions across build pipelines and production hosts to identify instances still below 8.4

How to Mitigate CVE-2026-76825

Immediate Actions Required

Upgrade RestrictedPython to version 8.4 or later across all environments that compile or execute untrusted Python
Audit custom import policies and globals dictionaries and remove exposure of string, string.Formatter, Formatter instances, and Formatter subclasses to restricted code
Review historical restricted code submissions for format string traversal patterns to identify any prior exploitation attempts

Patch Information

The vulnerability is fixed in RestrictedPython 8.4. The patch imports the string module into Guards.py and extends safer_getattr to block access to string.Formatter and its unsafe traversal methods. See the GitHub Release 8.4 and the GitHub Security Advisory GHSA-hp3v-5vw7-fx9w for full details.

Workarounds

Remove the string module from any custom import policy and from globals passed to compile_restricted output
Avoid passing Formatter classes, instances, or subclasses through globals to restricted code
Run RestrictedPython workloads under least-privilege OS accounts and network egress controls to limit blast radius until patching completes

bash

# Upgrade RestrictedPython to the patched release
pip install --upgrade 'RestrictedPython>=8.4'

# Verify installed version
python -c "import RestrictedPython; print(RestrictedPython.__version__)"