high7.9
CVE-2025-22153
try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter
Impact
### Impact Via a type confusion bug in the CPython interpreter when using `try/except*` RestrictedPython could be bypassed. We believe this should be fixed upstream in Python itself until that we remove support for `try/except*` from RestrictedPython. (It has been fixed for some Python versions.) ### Patches Patched in version 8.0 by removing support for `try/except*` clauses ### Workarounds There is no workaround. ### References none
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | RestrictedPython | >= 6.0, < 8.0 | 8.0 |
Affected products
| Product | Affected versions |
|---|---|
| 3.11 And | before 3.13.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/zopefoundation/RestrictedPython/commit/48a92c5bb617a647cffd0dadd4d5cfe626bcdb2f
- https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-gmj9-h825-chq2
- https://github.com/advisories/GHSA-gmj9-h825-chq2
- https://nvd.nist.gov/vuln/detail/CVE-2025-22153