Type Confusion Vulnerability in RestrictedPython Package
Summary
DEBIAN-CVE-2025-22153: RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Affects restrictedpython versions < 8.0-1. Fixed in 8.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RestrictedPython is a tool designed to create a controlled subset of the Python programming language, enabling secure execution of Python code in a trusted environment. It is commonly used in applications where user input needs to be executed safely, such as in web applications or educational tools. The package allows developers to define what parts of Python can be used, thereby minimizing the risk of executing harmful code. However, it has recently been found to have a vulnerability that could allow attackers to bypass its security measures.
Vulnerability Detail
The vulnerability arises from a type confusion bug in the CPython interpreter, affecting versions starting from 3.11 up to, but not including, 3.13.2. When using 'try/except*' clauses, RestrictedPython versions 6.0 to 8.0 could be exploited, allowing unauthorized access to the underlying Python environment. This could lead to the execution of arbitrary code, compromising the security of applications relying on RestrictedPython for safe code execution.
How To Fix
Minimum fixed version
8.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade restrictedpythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability other than updating to the patched version of RestrictedPython.
Conclusion
The RestrictedPython package has a critical vulnerability due to a type confusion bug in the CPython interpreter, affecting versions 6.0 to 8.0. It is crucial to update to version 8.0-1 to mitigate this risk. Regular monitoring and updates are essential for maintaining application security.
See every vulnerability recorded for restrictedpython →
FAQ
The vulnerability is a type confusion bug in the CPython interpreter that allows bypassing security measures in RestrictedPython versions 6.0 to 8.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to fix this vulnerability could allow attackers to execute arbitrary code, potentially compromising the security of applications that rely on RestrictedPython.
Yes, version 8.0-1 of RestrictedPython addresses this vulnerability by removing support for 'try/except*' clauses.
If immediate updating is not possible, ensure that your application is not exposed to untrusted input that could exploit this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for restrictedpython.
