CVE-2024-47532
RestrictedPython information leakage via `AttributeError.obj` and the `string` module
RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
RestrictedPython information leakage via `AttributeError.obj` and the `string` module
RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
- Record
CVE-2024-47532- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2024-0156
RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
- Record
EUVD-2024-0156- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5rfv-66g4-jr8h
RestrictedPython information leakage via `AttributeError.obj` and the `string` module
Impact
A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module.
Patches
The problem will be fixed in version 7.3.
Workarounds
If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
- Record
GHSA-5rfv-66g4-jr8h- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
- Record
CVE-2024-47532- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
RestrictedPython information leakage via `AttributeError.obj` and the `string` module
RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
- Record
CVE-2024-47532- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-47532
RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
- Record
DEBIAN-CVE-2024-47532- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-5rfv-66g4-jr8h
RestrictedPython information leakage via `AttributeError.obj` and the `string` module
Impact
A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module.
Patches
The problem will be fixed in version 7.3.
Workarounds
If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
- Record
GHSA-5rfv-66g4-jr8h- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVPYSEC-2024-186
RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
- Record
PYSEC-2024-186- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-47532
RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
- Record
UBUNTU-CVE-2024-47532- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUSN-7355-1 No score
restrictedpython vulnerabilities
Nakul Choudhary and Robert Xiao discovered that RestrictedPython did not properly sanitize certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-37271)
Abhishek Govindarasu, Ankush Menat and Ward Theunisse discovered that RestrictedPython did not correctly handle certain format strings. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-41039)
It was discovered that RestrictedPython did not correctly restrict access to certain fields. An attacker could possibly use this issue to leak sensitive information. (CVE-2024-47532)
It was discovered that RestrictedPython contained a type confusion vulnerability. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2025-22153)
- Record
USN-7355-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
restrictedpythonPyPI |
before 7.3 | 7.3 |
restrictedpythonDebian:12 |
All versions, plus listed versions 4.0~b3-36.2-18.0-18.1-18.4-1 |
None known |
restrictedpythonDebian:13 |
before 8.0-1 | 8.0-1 |
restrictedpythonDebian:14 |
before 8.0-1 | 8.0-1 |
restrictedpythonPyPI |
before 7.3, plus listed versions 3.4.23.4.33.5.03.5.13.5.2 Show 32 moreShow less3.6.03.6.0a14.04.0a14.0a24.0a34.0b14.0b24.0b34.0b44.0b54.0b64.0b74.0b85.05.15.25.2a1.dev05.35.3a1.dev05.46.06.0a1.dev06.16.27.07.0a1.dev07.0a1.dev17.0a2.dev07.17.27.2a1.dev0 |
7.3 |
restrictedpythonUbuntu:Pro:20.04:LTS |
before 4.0~b3-2ubuntu0.1~esm1, plus listed versions 4.0~b3-2 |
4.0~b3-2ubuntu0.1~esm1 |
restrictedpythonUbuntu:Pro:22.04:LTS |
before 4.0~b3-3ubuntu0.1~esm1, plus listed versions 4.0~b3-24.0~b3-2ubuntu14.0~b3-3 |
4.0~b3-3ubuntu0.1~esm1 |
restrictedpythonUbuntu:Pro:24.04:LTS |
before 6.2-1ubuntu0.24.04.1~esm1, plus listed versions 4.0~b3-36.2-1 |
6.2-1ubuntu0.24.04.1~esm1 |
restrictedpythonUbuntu:Pro:20.04:LTS From an advisory covering 4 CVEs |
before 4.0~b3-2ubuntu0.1~esm1, plus listed versions 4.0~b3-2 |
4.0~b3-2ubuntu0.1~esm1 |
restrictedpythonUbuntu:Pro:22.04:LTS From an advisory covering 4 CVEs |
before 4.0~b3-3ubuntu0.1~esm1, plus listed versions 4.0~b3-24.0~b3-2ubuntu14.0~b3-3 |
4.0~b3-3ubuntu0.1~esm1 |
restrictedpythonUbuntu:Pro:24.04:LTS From an advisory covering 4 CVEs |
before 6.2-1ubuntu0.24.04.1~esm1, plus listed versions 4.0~b3-36.2-1 |
6.2-1ubuntu0.24.04.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-47532 is a high vulnerability (CVSS 8.7) in Zope Restrictedpython, published September 30, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in restrictedpython 7.3.
References
github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-5rfv-66g4-jr8h
nvd.nist.gov/vuln/detail/CVE-2024-47532
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2024-47532
ubuntu.com/security/CVE-2024-47532
cve.org/CVERecord?id=CVE-2024-47532