CVE-2023-41039

RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone controlling the format string to "read" all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure. With `RestrictedPython`, the format functionality is available via the `format` and `format_map` methods of `str` (and `unicode`) (accessed either via the class or its instances) and via `string.Formatter`. All known versions of `RestrictedPython` are vulnerable. This issue has been addressed in commit `4134aedcff1` which has been included in the 5.4 and 6.2 releases. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-74

• https://github.com/zopefoundation/RestrictedPython/commit/4134aedcff17c977da7717693ed89ce56d54c120Patch
• https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67Vendor Advisory
• https://github.com/zopefoundation/RestrictedPython/commit/4134aedcff17c977da7717693ed89ce56d54c120Patch
• https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67Vendor Advisory

Published

Aug 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41032A vulnerability has been identified in Parasolid V34.1 (All …7.8
• CVE-2023-41033A vulnerability has been identified in Parasolid V35.0 (All …7.8
• CVE-2023-41034Eclipse Leshan is a device management server and client Java…9.8
• CVE-2023-41036Macvim is a text editor for MacOS. Prior to version 178, Mac…7.8
• CVE-2023-41037OpenPGP.js is a JavaScript implementation of the OpenPGP pro…4.3
• CVE-2023-41038Firebird is a relational database. Versions 4.0.0 through 4.…7.5
• CVE-2023-4104An invalid Polkit Authentication check and missing authentic…5.5
• CVE-2023-41040GitPython is a python library used to interact with Git repo…6.5
• CVE-2023-41041Graylog is a free and open log management platform. In a mul…3.1
• CVE-2023-41042Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2023-41043Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2023-41044Graylog is a free and open log management platform. A partia…3.8