{"id":"CVE-2025-22153","aliases":["DEBIAN-CVE-2025-22153","EUVD-2025-0162","GHSA-gmj9-h825-chq2","PYSEC-2026-1874","UBUNTU-CVE-2025-22153","USN-7355-1"],"status":"published","title":"try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter","description":"RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available.","severity":{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.004,"percentile":0.34495,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-843"],"published":"2025-01-23T17:19:34Z","modified":"2026-10-28T02:30:34Z","fixes":[{"ecosystem":"PyPI","package":"restrictedpython","fixed_in":["8.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"restrictedpython","fixed_in":["8.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"restrictedpython","fixed_in":["8.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"restrictedpython","fixed_in":["6.2-1ubuntu0.24.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"restrictedpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"8.0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"restrictedpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"restrictedpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"restrictedpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"8.0"}]}],"versions":["6.0","6.1","6.2","7.0","7.0a1.dev0","7.0a1.dev1","7.0a2.dev0","7.1","7.2","7.2a1.dev0","7.3","7.4"]},{"source":"osv","ecosystem":"PyPI","package":"restrictedpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"8.0"}]}],"versions":["6.0","6.1","6.2","7.0","7.0a1.dev0","7.0a1.dev1","7.0a2.dev0","7.1","7.2","7.2a1.dev0","7.3","7.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"restrictedpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-1ubuntu0.24.04.1~esm1"}]}],"versions":["4.0~b3-3","6.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"restrictedpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0~b3-2ubuntu0.1~esm1"}]}],"versions":["4.0~b3-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"restrictedpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0~b3-3ubuntu0.1~esm1"}]}],"versions":["4.0~b3-2","4.0~b3-2ubuntu1","4.0~b3-3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"restrictedpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-1ubuntu0.24.04.1~esm1"}]}],"versions":["4.0~b3-3","6.2-1"],"bundled":4}],"products":[{"vendor":"zopefoundation","product":"restrictedpython"}],"references":[{"url":"https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-gmj9-h825-chq2","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/zopefoundation/RestrictedPython/commit/48a92c5bb617a647cffd0dadd4d5cfe626bcdb2f","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22153","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gmj9-h825-chq2","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22153.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-22153","tags":["advisory"]},{"url":"https://github.com/zopefoundation/RestrictedPython","tags":["package"]},{"url":"https://pypi.org/project/restrictedpython","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-22153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-22153","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7355-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-37271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-41039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47532","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-22153","title":"try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter","description":"RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available.","status":"published","published":"2025-01-23T17:34:27.056Z","modified":"2025-02-12T20:41:29.946Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:32:29.286772Z"}],"euvd":[{"id":"EUVD-2025-0162","description":"RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available.","status":"published","published":"2025-01-23T17:34:27Z","modified":"2025-02-12T20:41:29Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-03T00:03:56.514594Z"}],"ghsa":[{"id":"GHSA-gmj9-h825-chq2","title":"try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter","description":"### Impact\nVia a type confusion bug in the CPython interpreter when using `try/except*` RestrictedPython could be bypassed.\n\nWe believe this should be fixed upstream in Python itself until that we remove support for `try/except*` from RestrictedPython.\n(It has been fixed for some Python versions.)\n\n### Patches\nPatched in version 8.0 by removing support for `try/except*` clauses\n\n### Workarounds\nThere is no workaround.\n\n### References\nnone\n","status":"published","published":"2025-01-23T17:19:34Z","modified":"2025-01-23T23:17:22Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:38:28.945236Z"}],"nvd":[{"id":"CVE-2025-22153","description":"RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available.","status":"published","published":"2025-01-23T18:15:33.267Z","modified":"2026-06-17T08:45:23.5Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:10:49.483601Z"}],"osv":[{"id":"CVE-2025-22153","title":"try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter","description":"RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available.","status":"published","published":"2025-01-23T17:34:27.056Z","modified":"2026-10-28T02:30:34.793914565Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:44:47.009967Z"},{"id":"DEBIAN-CVE-2025-22153","description":"RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available.","status":"published","published":"2025-01-23T18:15:33.267Z","modified":"2026-09-01T20:05:44.134056606Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:45.524682Z"},{"id":"GHSA-gmj9-h825-chq2","title":"try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter","description":"### Impact\nVia a type confusion bug in the CPython interpreter when using `try/except*` RestrictedPython could be bypassed.\n\nWe believe this should be fixed upstream in Python itself until that we remove support for `try/except*` from RestrictedPython.\n(It has been fixed for some Python versions.)\n\n### Patches\nPatched in version 8.0 by removing support for `try/except*` clauses\n\n### Workarounds\nThere is no workaround.\n\n### References\nnone\n","status":"published","published":"2025-01-23T17:19:34Z","modified":"2026-07-07T17:57:15.763423383Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"PYSEC-2026-1874","title":"try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter","description":"### Impact\nVia a type confusion bug in the CPython interpreter when using `try/except*` RestrictedPython could be bypassed.\n\nWe believe this should be fixed upstream in Python itself until that we remove support for `try/except*` from RestrictedPython.\n(It has been fixed for some Python versions.)\n\n### Patches\nPatched in version 8.0 by removing support for `try/except*` clauses\n\n### Workarounds\nThere is no workaround.\n\n### References\nnone\n","status":"published","published":"2026-07-07T14:34:49.069993Z","modified":"2026-07-07T17:46:36.748663368Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"UBUNTU-CVE-2025-22153","description":"RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available.","status":"published","published":"2025-01-23T18:15:00Z","modified":"2026-02-04T04:15:42.402249Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"USN-7355-1","title":"restrictedpython vulnerabilities","description":"Nakul Choudhary and Robert Xiao discovered that RestrictedPython did not\nproperly sanitize certain inputs. An attacker could possibly use this\nissue to execute arbitrary code. This issue only affected\nUbuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-37271)\n\nAbhishek Govindarasu, Ankush Menat and Ward Theunisse discovered that\nRestrictedPython did not correctly handle certain format strings. An\nattacker could possibly use this issue to leak sensitive information.\nThis issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.\n(CVE-2023-41039)\n\nIt was discovered that RestrictedPython did not correctly restrict access\nto certain fields. An attacker could possibly use this issue to leak\nsensitive information. (CVE-2024-47532)\n\nIt was discovered that RestrictedPython contained a type confusion\nvulnerability. An attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 24.04 LTS and\nUbuntu 24.10. (CVE-2025-22153)\n","status":"published","published":"2025-03-18T23:59:57Z","modified":"2026-04-27T17:48:50.897198Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}