CVE-2023-41039

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone controlling the format string to "read" all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure. With `RestrictedPython`, the format functionality is available via the `format` and `format_map` methods of `str` (and `unicode`) (accessed either via the class or its instances) and via `string.Formatter`. All known versions of `RestrictedPython` are vulnerable. This issue has been addressed in commit `4134aedcff1` which has been included in the 5.4 and 6.2 releases. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Aug 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-41045.5An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitra CVE-2023-410406.5GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from th CVE-2023-410413.1Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session CVE-2023-410426.5Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `te CVE-2023-410436.5Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `te CVE-2023-410443.8Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's `Support Bundle` feature. The CVE-2023-410455.3Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single CVE-2023-410466.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute CVE-2023-410476.5OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious CVE-2023-410485.4plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions CVE-2023-410496.1@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in CVE-2023-41054.3Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and downloa