CVE-2025-22153
try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using try/except*, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for try/except* clauses. No known workarounds are available.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using try/except*, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for try/except* clauses. No known workarounds are available.
- Record
CVE-2025-22153- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-843
- Updated
- 2026-11-02
EUVDEUVD-2025-0162
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using try/except*, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for try/except* clauses. No known workarounds are available.
- Record
EUVD-2025-0162- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gmj9-h825-chq2
try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter
Impact
Via a type confusion bug in the CPython interpreter when using try/except* RestrictedPython could be bypassed.
We believe this should be fixed upstream in Python itself until that we remove support for try/except* from RestrictedPython.
(It has been fixed for some Python versions.)
Patches
Patched in version 8.0 by removing support for try/except* clauses
Workarounds
There is no workaround.
References
none
- Record
GHSA-gmj9-h825-chq2- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-843
- Updated
- 2026-11-02
NVD
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using try/except*, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for try/except* clauses. No known workarounds are available.
- Record
CVE-2025-22153- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-843
- Updated
- 2026-11-02
OSV
try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using try/except*, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for try/except* clauses. No known workarounds are available.
- Record
CVE-2025-22153- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-843
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-22153
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using try/except*, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for try/except* clauses. No known workarounds are available.
- Record
DEBIAN-CVE-2025-22153- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-gmj9-h825-chq2
try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter
Impact
Via a type confusion bug in the CPython interpreter when using try/except* RestrictedPython could be bypassed.
We believe this should be fixed upstream in Python itself until that we remove support for try/except* from RestrictedPython.
(It has been fixed for some Python versions.)
Patches
Patched in version 8.0 by removing support for try/except* clauses
Workarounds
There is no workaround.
References
none
- Record
GHSA-gmj9-h825-chq2- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-843
- Updated
- 2026-11-02
OSVPYSEC-2026-1874
try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter
Impact
Via a type confusion bug in the CPython interpreter when using try/except* RestrictedPython could be bypassed.
We believe this should be fixed upstream in Python itself until that we remove support for try/except* from RestrictedPython.
(It has been fixed for some Python versions.)
Patches
Patched in version 8.0 by removing support for try/except* clauses
Workarounds
There is no workaround.
References
none
- Record
PYSEC-2026-1874- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-22153
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using try/except*, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for try/except* clauses. No known workarounds are available.
- Record
UBUNTU-CVE-2025-22153- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVUSN-7355-1 No score
restrictedpython vulnerabilities
Nakul Choudhary and Robert Xiao discovered that RestrictedPython did not properly sanitize certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-37271)
Abhishek Govindarasu, Ankush Menat and Ward Theunisse discovered that RestrictedPython did not correctly handle certain format strings. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-41039)
It was discovered that RestrictedPython did not correctly restrict access to certain fields. An attacker could possibly use this issue to leak sensitive information. (CVE-2024-47532)
It was discovered that RestrictedPython contained a type confusion vulnerability. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2025-22153)
- Record
USN-7355-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
restrictedpythonPyPI |
6.0 up to 8.0 | 8.0 |
restrictedpythonDebian:13 |
before 8.0-1 | 8.0-1 |
restrictedpythonDebian:14 |
before 8.0-1 | 8.0-1 |
restrictedpythonPyPI |
6.0 up to 8.0, plus listed versions 6.16.27.07.0a1.dev07.0a1.dev1 Show 6 moreShow less7.0a2.dev07.17.27.2a1.dev07.37.4 |
8.0 |
restrictedpythonUbuntu:Pro:24.04:LTS |
before 6.2-1ubuntu0.24.04.1~esm1, plus listed versions 4.0~b3-36.2-1 |
6.2-1ubuntu0.24.04.1~esm1 |
restrictedpythonUbuntu:Pro:20.04:LTS From an advisory covering 4 CVEs |
before 4.0~b3-2ubuntu0.1~esm1, plus listed versions 4.0~b3-2 |
4.0~b3-2ubuntu0.1~esm1 |
restrictedpythonUbuntu:Pro:22.04:LTS From an advisory covering 4 CVEs |
before 4.0~b3-3ubuntu0.1~esm1, plus listed versions 4.0~b3-24.0~b3-2ubuntu14.0~b3-3 |
4.0~b3-3ubuntu0.1~esm1 |
restrictedpythonUbuntu:Pro:24.04:LTS From an advisory covering 4 CVEs |
before 6.2-1ubuntu0.24.04.1~esm1, plus listed versions 4.0~b3-36.2-1 |
6.2-1ubuntu0.24.04.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-22153 is a high vulnerability (CVSS 7.9) in Zopefoundation Restrictedpython, published January 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in restrictedpython 8.0.
References
github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-gmj9-h825-chq2
nvd.nist.gov/vuln/detail/CVE-2025-22153
security-tracker.debian.org/tracker/CVE-2025-22153