CVE-2026-55830
High
Description
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, check_function_argument_names() rejected protected guard hook names for regular, variadic, and keyword-only arguments but omitted positional-only arguments, allowing __getattr__, _getitem_, _write_, or _print_ to be shadowed by a local parameter and bypass the embedding application's access policy. This issue is fixed in version 8.3.
SeverityHigh
CVSS8.3
Exploit probability—
ProductRestrictedpython
PublishedJul 8, 2026
First seenJul 8, 2026
Weakness typeCWE-184CWE-184
How to fix
Update
- restrictedpython8.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| restrictedpythonPyPI | v < 8.3 | 8.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.