CVE-2023-37271 RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape

RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generat...

Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated) Vulnerability

Exploit Title: Frappe Framework ERPNext 13.4.0 - Remote Code Execution Authenticated Exploit Author: Sander Ferdinand Version: 13.4.0 Vendor Homepage: http://erpnext.org Software Link: https://github.com/frappe/frappe/ Tested on: Ubuntu 22.04 CVE : none Silly sandbox escape. Frappe Framework uses...

CVE-2023-37271: Improper Control of Dynamically-Managed Code Resources

RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generat...

RestrictedPython security vulnerabilities

RestrictedPython is a tool that helps define a subset of the Python language that allows program input to be provided to a trusted environment. A security vulnerability exists in RestrictedPython versions prior to 5.3, and prior to 6.1, which stems from allowing a user to provide program input to...

Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated)

Exploit Title: Frappe Framework ERPNext 13.4.0 - Remote Code Execution Authenticated Exploit Author: Sander Ferdinand Date: 2023-06-07 Version: 13.4.0 Vendor Homepage: http://erpnext.org Software Link: https://github.com/frappe/frappe/ Tested on: Ubuntu 22.04 CVE : none Silly sandbox escape. Frap...

GHSA-WQC8-X2PR-7JQH RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape

Impact RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generator expressions, which are allowed inside RestrictedPython. An attacker with access to a RestrictedPython environment can write code that gets the...

RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape

Impact RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generator expressions, which are allowed inside RestrictedPython. An attacker with access to a RestrictedPython environment can write code that gets the...

aimmo (>=0.4.0b3098, <=0.27.4b5229), codeforlife-portal (>=1.1.1, <=1.2.1) potentially affected by CVE-2023-37271 via restrictedpython (4.0.0b7)

restrictedpython PYPI version 4.0.0b7 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - aimmo =0.4.0b3098, =1.1.1, =1.2.1 Source cves: CVE-2023-37271 Source advisory: OSV:GHSA-WQC8-X2PR-7JQH...

dektools (>=0.1.0, <=0.1.117), dimensigon (>=0.3.4, <=0.3.5) +2 more potentially affected by CVE-2023-37271 via restrictedpython (>=5.0.0, <=5.2.0)

restrictedpython PYPI version =5.0.0, =0.1.0, =0.3.4, =0.0.41a1, =0.1047.0, =1.7.36 Source cves: CVE-2023-37271 Source advisory: OSV:GHSA-WQC8-X2PR-7JQH...

a2grunnerp (>=0.1.0, <=0.1.8), dcicsnovault (>=2.0.0b4, <=2.0.0b7) +5 more potentially affected by CVE-2023-37271 via restrictedpython (>=6.0.0a1.dev0, <=6.0.0)

restrictedpython PYPI version =6.0.0a1.dev0, =0.1.0, =2.0.0b4, =0.0.42a3, =2.10.0, =2025.9.5, =4.8.4, =4.8.11 Source cves: CVE-2023-37271 Source advisory: OSV:GHSA-WQC8-X2PR-7JQH...

battlehack20 (>=1.0.0, <=1.1.0), battlehack20-fancyviewer (>=1.0.1, <=1.0.5) potentially affected by CVE-2023-37271 via restrictedpython (4.0.0b4)

restrictedpython PYPI version 4.0.0b4 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - battlehack20 =1.0.0, =1.0.1, =1.0.5 Source cves: CVE-2023-37271 Source advisory: OSV:GHSA-WQC8-X2PR-7JQH...

a2grunnerp (>=0.1.0, <=0.1.8), dcicsnovault (>=2.0.0b4, <=2.0.0b7) +5 more potentially affected by CVE-2023-37271 via restrictedpython (>=6.0.0a1.dev0, <=6.0.0)

restrictedpython PYPI version =6.0.0a1.dev0, =0.1.0, =2.0.0b4, =0.0.42a3, =2.10.0, =2025.9.5, =4.8.4, =4.8.11 Source cves: CVE-2023-37271 Source advisory: GHSA-WQC8-X2PR-7JQH...

aimmo (>=0.4.0b3098, <=0.27.4b5229), battlehack20 (>=1.0.0, <=1.1.0) +6 more potentially affected by CVE-2023-37271 via restrictedpython (>=4.0.0b4, <=5.2.0)

restrictedpython PYPI version =4.0.0b4, =0.4.0b3098, =1.0.0, =1.0.1, =1.1.1, =0.1.0, =0.3.4, =0.0.41a1, =0.1047.0, =1.7.36 Source cves: CVE-2023-37271 Source advisory: GHSA-WQC8-X2PR-7JQH...

PT-2023-25874

Name of the Vulnerable Software and Affected Versions RestrictedPython versions prior to 5.3 RestrictedPython versions prior to 6.1 Description The issue allows an attacker with access to a RestrictedPython environment to write code that gets the current stack frame in a generator and then walk t...

CentOS 5 : conga (CESA-2014:1194)

Updated conga packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings...

(Plone): Restricted Python injection

It was discovered that Plone, included as a part of luci, did not properly protect the privilege of running RestrictedPython scripts. A remote attacker could use a specially crafted URL that, when processed, would allow the attacker to submit and perform expensive computations or, in conjunction...