CVE-2026-76825

Sandbox escape via string.Formatter bypassing RestrictedPython's protections.

• CVSS 8.4
• 200
• Design Defects
• Remote

RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPython could allow a sandbox escape when a custom import policy or globals exposed the standard library string module, the string.Formatter class, a Formatter instance, or a Formatter subclass to restricted code. The string.Formatter methods format, get_field, get_value, and vformat performed attribute and item traversal internally without passing through RestrictedPython's safer_getattr protections. Restricted code could use those live object references to reach function globals, builtins, file access, or code execution primitives, affecting confidentiality, integrity, and availability in the host environment. This issue is fixed in version 8.4.

CVE

CVE-2026-76825

CWE

200

CVSS base score

8.4

Published

2026-09-16

OWASP

A04 Insecure Design

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Design Defects

Subcategory

Poorly Designed Access Controls

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

RestrictedPython

Fixed by upgrading

Yes

Solution

Upgrade RestrictedPython to version 8.4 or newer.

import string

def render(template, *args, **kwargs):
    # VULNERABLE: raw Formatter allows attribute/item traversal
    fmt = string.Formatter()
    return fmt.format(template, *args, **kwargs)

import string

def render(template, *args, **kwargs):
    # FIX: SafeFormatter restricts attribute/item traversal
    class SafeFormatter(string.Formatter):
        def get_field(self, field_name, args, kwargs):
            # Allow only simple positional fields like "0", "1", ...
            if field_name.isdigit():
                return super().get_field(field_name, args, kwargs)
            raise ValueError("Unsafe field name")
    fmt = SafeFormatter()
    return fmt.format(template, *args, **kwargs)

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202676825,
  title        = {{Sandbox escape via string.Formatter bypassing RestrictedPython's protections.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-76825},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-76825/}}
}