RestrictedPython information leakage via `AttributeError.obj` and the `string` module
Impact
A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module.
Patches
The problem will be fixed in version 7.3.
Workarounds
If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | restrictedpython | < 7.3 | 7.3 |
References
- https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-5rfv-66g4-jr8h
- https://github.com/zopefoundation/RestrictedPython/commit/d701cc36cccac36b21fa200f1f2d1945a9a215e6
- https://nvd.nist.gov/vuln/detail/CVE-2024-47532
- https://github.com/pypa/advisory-database/tree/main/vulns/restrictedpython/PYSEC-2024-186.yaml
- https://github.com/zopefoundation/RestrictedPython
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-200- Platform
- Python (PyPI)
- Package
restrictedpython- Disclosed
- 30.09.2024
- Updated
- 11.10.2026 12:19
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2024-186 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-5rfv-66g4-jr8h - CC BY 4.0
Vulnerability history: restrictedpython
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 07.2023 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 6
Disclosures per year
- 2023: 2
- 2024: 1
- 2025: 1
- 2026: 2
-
RestrictedPython information leakage via `AttributeError.obj` and the `string` module this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.