CVE-2023-41050
Information disclosure through Python's "format" functionality in Zope AccessControl
AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy restricted AccessControl variants _getattr_ and _getitem_. This can lead to critical information disclosure. AccessControl already provides a safe variant for str.format and denies access to string.Formatter. However, str.format_map is still unsafe. Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it. A fix has been introduced in versions 4.4, 5.8 and 6.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Information disclosure through Python's "format" functionality in Zope AccessControl
AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy restricted AccessControl variants _getattr_ and _getitem_. This can lead to critical information disclosure. AccessControl already provides a safe variant for str.format and denies access to string.Formatter. However, str.format_map is still unsafe. Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it. A fix has been introduced in versions 4.4, 5.8 and 6.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-41050- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2023-2467
AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy restricted AccessControl variants _getattr_ and _getitem_. This can lead to critical information disclosure. AccessControl already provides a safe variant for str.format and denies access to string.Formatter. However, str.format_map is still unsafe. Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it. A fix has been introduced in versions 4.4, 5.8 and 6.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2023-2467- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8xv7-89vj-q48c
Information disclosure in AccessControl
Impact
Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy restricted AccessControl variants _getattr_ and _getitem_. This can lead to critical information disclosure.
AccessControl already provides a safe variant for str.format and denies access to string.Formatter. However, str.format_map is still unsafe.
Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it.
Patches
A fix will be introduced in the versions 4.4, 5.8 and 6.2.
Workarounds
There are no workarounds.
References
https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67 describes the corresponding problem for RestrictedPython.
- Record
GHSA-8xv7-89vj-q48c- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy restricted AccessControl variants _getattr_ and _getitem_. This can lead to critical information disclosure. AccessControl already provides a safe variant for str.format and denies access to string.Formatter. However, str.format_map is still unsafe. Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it. A fix has been introduced in versions 4.4, 5.8 and 6.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-41050- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Information disclosure through Python's "format" functionality in Zope AccessControl
AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy restricted AccessControl variants _getattr_ and _getitem_. This can lead to critical information disclosure. AccessControl already provides a safe variant for str.format and denies access to string.Formatter. However, str.format_map is still unsafe. Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it. A fix has been introduced in versions 4.4, 5.8 and 6.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-41050- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-8xv7-89vj-q48c
Information disclosure in AccessControl
Impact
Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy restricted AccessControl variants _getattr_ and _getitem_. This can lead to critical information disclosure.
AccessControl already provides a safe variant for str.format and denies access to string.Formatter. However, str.format_map is still unsafe.
Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it.
Patches
A fix will be introduced in the versions 4.4, 5.8 and 6.2.
Workarounds
There are no workarounds.
References
https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67 describes the corresponding problem for RestrictedPython.
- Record
GHSA-8xv7-89vj-q48c- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVPYSEC-2026-2075
Information disclosure in AccessControl
Impact
Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy restricted AccessControl variants _getattr_ and _getitem_. This can lead to critical information disclosure.
AccessControl already provides a safe variant for str.format and denies access to string.Formatter. However, str.format_map is still unsafe.
Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it.
Patches
A fix will be introduced in the versions 4.4, 5.8 and 6.2.
Workarounds
There are no workarounds.
References
https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67 describes the corresponding problem for RestrictedPython.
- Record
PYSEC-2026-2075- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVPYSEC-2026-2325
Information disclosure in AccessControl
Impact
Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy restricted AccessControl variants _getattr_ and _getitem_. This can lead to critical information disclosure.
AccessControl already provides a safe variant for str.format and denies access to string.Formatter. However, str.format_map is still unsafe.
Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it.
Patches
A fix will be introduced in the versions 4.4, 5.8 and 6.2.
Workarounds
There are no workarounds.
References
https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67 describes the corresponding problem for RestrictedPython.
- Record
PYSEC-2026-2325- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
accesscontrolPyPI |
before 4.4 | 4.4 |
zopePyPI |
before 4.8.9 | 4.8.9 |
accesscontrolPyPI |
5.0 up to 5.8 | 5.8 |
accesscontrolPyPI |
6.0 up to 6.2 | 6.2 |
zopePyPI |
5.0.0 up to 5.8.4 | 5.8.4 |
accesscontrolPyPI |
before 4.4, plus listed versions 2.13.02.13.12.13.102.13.112.13.12 Show 45 moreShow less2.13.132.13.142.13.152.13.162.13.22.13.32.13.42.13.52.13.62.13.72.13.82.13.93.03.0.13.0.103.0.113.0.123.0.133.0.143.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.94.04.0a14.0a24.0a34.0a44.0a54.0a64.0a74.0b14.0b24.0b34.0b44.0b54.0b64.0b74.14.24.3 |
4.4 |
zopePyPI |
before 4.8.9, plus listed versions 4.04.0b14.0b104.0b24.0b3 Show 38 moreShow less4.0b44.0b54.0b64.0b74.0b84.0b94.14.1.14.1.24.1.34.24.2.14.34.44.4.14.4.24.4.34.4.44.54.5.14.5.24.5.34.5.44.5.54.64.6.14.6.24.6.34.74.84.8.14.8.24.8.34.8.44.8.54.8.64.8.74.8.8 |
4.8.9 |
accesscontrolPyPI |
5.0 up to 5.8, plus listed versions 5.15.25.35.3.15.45.55.65.7 |
5.8 |
accesscontrolPyPI |
6.0 up to 6.2, plus listed versions 6.1 |
6.2 |
zopePyPI |
5.0.0 up to 5.8.4, plus listed versions 5.05.15.1.15.1.25.2 Show 15 moreShow less5.2.15.35.45.55.5.15.5.25.65.75.7.15.7.25.7.35.85.8.15.8.25.8.3 |
5.8.4 |
zopePyPI |
before 4.8.9, 5.0.0 up to 5.8.4, plus listed versions 4.04.0b14.0b104.0b24.0b3 Show 45 moreShow less4.0b44.0b54.0b64.0b74.0b84.0b94.14.1.14.1.24.1.34.24.2.14.34.44.4.14.4.24.4.34.4.44.54.5.14.5.24.5.34.5.44.5.54.64.6.14.6.24.6.34.74.84.8.14.8.24.8.34.8.44.8.54.8.64.8.74.8.85.05.15.1.15.1.25.25.2.15.3 |
4.8.95.8.4 |
accesscontrolPyPI |
before 4.4, 5.0 up to 5.8, 6.0 up to 6.2, plus listed versions 2.13.02.13.12.13.102.13.112.13.12 Show 45 moreShow less2.13.132.13.142.13.152.13.162.13.22.13.32.13.42.13.52.13.62.13.72.13.82.13.93.03.0.13.0.103.0.113.0.123.0.133.0.143.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.94.04.0a14.0a24.0a34.0a44.0a54.0a64.0a74.0b14.0b24.0b34.0b44.0b54.0b64.0b74.14.24.3 |
4.45.86.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-41050 is a medium vulnerability (CVSS 6.8) in Zope Accesscontrol, published September 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in accesscontrol 4.4.
References
github.com/zopefoundation/AccessControl/security/advisories/GHSA-8xv7-89vj-q48c
nvd.nist.gov/vuln/detail/CVE-2023-41050
pypi.org/project/zope
Left out here: 22 versions. The JSON record has them.