276 matches found
RestrictedPython injection vulnerability
RestrictedPython is a tool that helps define a subset of the Python language that allows program input to be provided to a trusted environment. RestrictedPython suffers from an injection vulnerability that stems from the fact that Python's format function allows a person controlling a format stri...
PT-2023-27754
Name of the Vulnerable Software and Affected Versions RestrictedPython versions prior to 5.4 RestrictedPython versions prior to 6.2 Description Python's "format" functionality allows someone controlling the format string to "read" all objects accessible through recursive attribute lookup and...
CVE-2023-41039: Improper Neutralization of Special Elements in Output Used by a Downstream Component
RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone controlling the format string to "read" all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to...
Arbitrary Code Execution
restrictedpython is vulnerable to Arbitrary Code Execution. The vulnerability exists because it does not properly restrict access to stack frames and attributes which allows an attacker to access the RestrictedPython environment and create code that receives the current stack frame from a...
Frappe Framework 13.4.0 Remote Code Execution
Exploit Title: Frappe Framework ERPNext 13.4.0 - Remote Code Execution Authenticated Exploit Author: Sander Ferdinand Date: 2023-06-07 Version: 13.4.0 Vendor Homepage: http://erpnext.org Software Link: https://github.com/frappe/frappe/ Tested on: Ubuntu 22.04 CVE : none Silly sandbox escape. Frap...
CVE-2023-37271
RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generat...
PYSEC-2023-118
RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generat...
PYSEC-2023-118
RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generat...
UBUNTU-CVE-2023-37271
RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generat...
Default configuration
RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generat...
dektools (>=0.1.0, <=0.1.117), dimensigon (>=0.3.4, <=0.3.5) +2 more potentially affected by CVE-2023-37271 via restrictedpython (>=5.0.0, <=5.2.0)
restrictedpython PYPI version =5.0.0, =0.1.0, =0.3.4, =0.0.41a1, =0.1047.0, =1.7.36 Source cves: CVE-2023-37271 Source advisory: OSV:PYSEC-2023-118...
battlehack20 (>=1.0.0, <=1.1.0), battlehack20-fancyviewer (>=1.0.1, <=1.0.5) potentially affected by CVE-2023-37271 via restrictedpython (4.0.0b4)
restrictedpython PYPI version 4.0.0b4 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - battlehack20 =1.0.0, =1.0.1, =1.0.5 Source cves: CVE-2023-37271 Source advisory: OSV:PYSEC-2023-118...
aimmo (>=0.4.0b3098, <=0.27.4b5229), codeforlife-portal (>=1.1.1, <=1.2.1) potentially affected by CVE-2023-37271 via restrictedpython (4.0.0b7)
restrictedpython PYPI version 4.0.0b7 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - aimmo =0.4.0b3098, =1.1.1, =1.2.1 Source cves: CVE-2023-37271 Source advisory: OSV:PYSEC-2023-118...
CVE-2023-37271
RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generat...
CVE-2023-37271 RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape
RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generat...
CVE-2023-37271
RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generat...
CVE-2023-37271
CVE-2023-37271 concerns RestrictedPython, a tool for sandboxing Python code. The vulnerability arises because RestrictedPython does not sanitize access to stack frames, allowing code inside generators/generator expressions to access the current stack frame and walk the stack beyond the sandbox bo...
CVE-2023-37271 RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape
RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generat...
aimmo (>=0.4.0b3098, <=0.27.4b5229), battlehack20 (>=1.0.0, <=1.1.0) +6 more potentially affected by CVE-2023-37271 via restrictedpython (>=4.0.0b4, <=5.2.0)
restrictedpython PYPI version =4.0.0b4, =0.4.0b3098, =1.0.0, =1.0.1, =1.1.1, =0.1.0, =0.3.4, =0.0.41a1, =0.1047.0, =1.7.36 Source cves: CVE-2023-37271 Source advisory: MEND:CVE-2023-37271...
a2grunnerp (>=0.1.0, <=0.1.8), dcicsnovault (>=2.0.0b4, <=2.0.0b7) +5 more potentially affected by CVE-2023-37271 via restrictedpython (>=6.0.0a1.dev0, <=6.0.0)
restrictedpython PYPI version =6.0.0a1.dev0, =0.1.0, =2.0.0b4, =0.0.42a3, =2.10.0, =2025.9.5, =4.8.4, =4.8.11 Source cves: CVE-2023-37271 Source advisory: MEND:CVE-2023-37271...