CVE-2023-41039

RestrictedPython is a restricted execution environment for Python to run
untrusted code. Python’s “format” functionality allows someone controlling
the format string to “read” all objects accessible through recursive
attribute lookup and subscription from objects he can access. This can lead
to critical information disclosure. With RestrictedPython, the format
functionality is available via the format and format_map methods of
str (and unicode) (accessed either via the class or its instances) and
via string.Formatter. All known versions of RestrictedPython are
vulnerable. This issue has been addressed in commit 4134aedcff1 which has
been included in the 5.4 and 6.2 releases. Users are advised to upgrade.
There are no known workarounds for this vulnerability.