CVE-2026-55830

The record

RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, check_function_argument_names() rejected protected guard hook names for regular, variadic, and keyword-only arguments but omitted positional-only arguments, allowing __getattr__, _getitem_, _write_, or _print_ to be shadowed by a local parameter and bypass the embedding application's access policy. This issue is fixed in version 8.3.

Affected packages

Related vulnerabilities

• CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184
• CVE-2026-114728 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184
• CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. CWE-184
• CVE-2026-102828 simple-git, an interface for running git commands in any node.js application, enables… CWE-184
• CVE-2026-102829 simple-git, an interface for running git commands in any node.js application, enables… CWE-184
• CVE-2026-87985 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass… CWE-184
• CVE-2026-87911 An OS command injection weakness in the read-only enforcement of the SQL validation… CWE-184
• CVE-2026-85788 Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon… CWE-184