{"id":"CVE-2023-41039","aliases":["GHSA-xjw2-6jm9-rf67","PYSEC-2023-159"],"url":"https://o3.security/vulnerability/CVE-2023-41039","summary":"Sandbox escape via various forms of \"format\" in RestrictedPython","details":"### Impact\nPython's \"format\" functionality allows someone controlling the format string to \"read\" all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure.\nWith `RestrictedPython`, the format functionality is available via the `format` and `format_map` methods of `str` (and `unicode`) (accessed either via the class or its instances) and via `string.Formatter`.\nAll known versions of `RestrictedPython` are vulnerable. \n\n### Patches\nThe issue will be fixed in 5.4 and 6.2.\n\n### Workarounds\nThere are no workarounds to fix the issue without upgrading.\n\n### References\n* https://docs.python.org/3/library/stdtypes.html#str.format_map\n* http://lucumr.pocoo.org/2016/12/29/careful-with-str-format/\n* https://www.exploit-db.com/exploits/51580\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in the [RestrictedPython issue tracker](https://github.com/zopefoundation/RestrictedPython/issues)\n* Email us at [security@plone.org](mailto:security@plone.org)\n\n### Credits\n\nThanks for analysing and reporting the go to:\n\n* Abhishek Govindarasu\n* Ankush Menat\n* Ward Theunisse\n\n","published":"2023-08-30T17:18:56.168Z","modified":"2026-08-12T03:51:23.017044529Z","cvss":{"score":8.3,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L"},"epss":{"score":0.00637,"percentile":0.4714,"asOf":"2026-08-07"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"restrictedpython","fixedVersion":"5.4"},{"ecosystem":"PyPI","name":"restrictedpython","fixedVersion":"6.2"}],"fix":{"url":"https://github.com/zopefoundation/RestrictedPython/commit/4134aedcff17c977da7717693ed89ce56d54c120","label":"zopefoundation/RestrictedPython@4134aed"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41039.json"},{"type":"ADVISORY","url":"https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41039"},{"type":"FIX","url":"https://github.com/zopefoundation/RestrictedPython/commit/4134aedcff17c977da7717693ed89ce56d54c120"},{"type":"PACKAGE","url":"https://github.com/zopefoundation/RestrictedPython"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:23.017044529Z"}}