Critical Vulnerability in RestrictedPython Package: Type Confusion in CPython Interpreter
Summary
UBUNTU-CVE-2025-22153: RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Affects restrictedpython versions 4.0~b3-3 – 6.2-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RestrictedPython is a tool designed to create a controlled subset of the Python programming language, enabling secure execution of untrusted code. It is widely used in applications that require a safe environment for executing user-defined scripts. The package allows developers to define a restricted execution environment, but it has been found vulnerable to a type confusion issue that can lead to security breaches.
Vulnerability Detail
The vulnerability arises from a type confusion bug in the CPython interpreter, affecting versions starting from 3.11 and prior to 3.13.2. When using 'try/except*' clauses, the RestrictedPython package, specifically versions 6.0 to 7.9, can be bypassed, allowing untrusted code to execute in an unrestricted manner. This could potentially lead to unauthorized access to sensitive data or system resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no known workarounds are available for this vulnerability. The best course of action is to update to the patched version as mentioned above.
Conclusion
The vulnerability in the RestrictedPython package poses significant risks due to a type confusion issue in the CPython interpreter. It is essential for users to update to the patched version to ensure the security of their applications. Regular monitoring for vulnerabilities using tools like Vulert can help maintain a secure environment.
See every vulnerability recorded for restrictedpython →
FAQ
The CVSS score of this vulnerability is 7.9, indicating a high severity level.
Versions of RestrictedPython from 6.0 to 7.9 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
While there are no workarounds available, it is crucial to prioritize updating the package to mitigate the risk.
More details can be found in the Ubuntu security notices and the CVE database.
Related vulnerabilities
Recent vulnerabilities recorded for restrictedpython.
