TEST-INFRA: [dependency-security] Vulnerabilities in RestrictedPython 7.0 #5913

Open
opened 2026-04-09 11:44:00 +00:00 by HAL9000 · 2 comments
Owner

Metadata

  • Branch: test-infra/dependency-security-restrictedpython-vulnerabilities
  • Commit Message: fix(deps): upgrade RestrictedPython to >=8.0 to patch CVE-2024-47532 and CVE-2025-22153
  • Milestone: (none — backlog)
  • Parent Epic: #5685

Summary

A security scan has identified critical vulnerabilities in RestrictedPython version 7.0, which is a dependency of this project. These vulnerabilities could allow an attacker to bypass the sandbox and access sensitive information or execute arbitrary code.

Vulnerability Details

1. Information Leakage via AttributeError.obj (CVE-2024-47532, GHSA-5rfv-66g4-jr8h)

  • Severity: HIGH
  • Description: A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module.
  • Affected Versions: All versions before 7.3
  • Patched Version: 7.3

2. Bypass via Type Confusion (CVE-2025-22153, GHSA-gmj9-h825-chq2)

  • Severity: HIGH
  • Description: A type confusion bug in the CPython interpreter when using try/except* could allow an attacker to bypass RestrictedPython.
  • Affected Versions: 6.0 to 7.4
  • Patched Version: 8.0

Upgrade RestrictedPython to >=8.0 to mitigate both vulnerabilities.

Duplicate Check

  • Search queries: "RestrictedPython vulnerability", "dependency security", "CVE-2024-47532", "CVE-2025-22153"
  • Results: 0 existing issues found for these vulnerabilities.
  • Justification: This is a new finding that has not been previously reported.

Subtasks

  • Identify all locations in pyproject.toml and requirements*.txt where RestrictedPython is pinned
  • Update the RestrictedPython dependency constraint to >=8.0
  • Run nox -e unit_tests to verify no regressions from the upgraded version
  • Run nox -e integration_tests to verify integration tests still pass
  • Run nox to confirm all quality gates pass with the updated dependency
  • Verify the CVEs are no longer flagged by the security scanner

Definition of Done

  • RestrictedPython is upgraded to >=8.0 in all dependency files
  • CVE-2024-47532 and CVE-2025-22153 are no longer present in security scan results
  • All unit tests pass (nox -e unit_tests)
  • All integration tests pass (nox -e integration_tests)
  • All nox stages pass
  • Coverage >= 97%

Backlog note: This issue was discovered during autonomous operation
on milestone v3.8.0. It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.


Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: new-issue-creator

## Metadata - **Branch**: `test-infra/dependency-security-restrictedpython-vulnerabilities` - **Commit Message**: `fix(deps): upgrade RestrictedPython to >=8.0 to patch CVE-2024-47532 and CVE-2025-22153` - **Milestone**: *(none — backlog)* - **Parent Epic**: #5685 ## Summary A security scan has identified critical vulnerabilities in `RestrictedPython` version `7.0`, which is a dependency of this project. These vulnerabilities could allow an attacker to bypass the sandbox and access sensitive information or execute arbitrary code. ## Vulnerability Details ### 1. Information Leakage via `AttributeError.obj` (CVE-2024-47532, GHSA-5rfv-66g4-jr8h) - **Severity:** HIGH - **Description:** A user can gain access to protected (and potentially sensible) information indirectly via `AttributeError.obj` and the `string` module. - **Affected Versions:** All versions before `7.3` - **Patched Version:** `7.3` ### 2. Bypass via Type Confusion (CVE-2025-22153, GHSA-gmj9-h825-chq2) - **Severity:** HIGH - **Description:** A type confusion bug in the CPython interpreter when using `try/except*` could allow an attacker to bypass RestrictedPython. - **Affected Versions:** `6.0` to `7.4` - **Patched Version:** `8.0` ## Recommended Action Upgrade `RestrictedPython` to `>=8.0` to mitigate both vulnerabilities. ### Duplicate Check - **Search queries:** "RestrictedPython vulnerability", "dependency security", "CVE-2024-47532", "CVE-2025-22153" - **Results:** 0 existing issues found for these vulnerabilities. - **Justification:** This is a new finding that has not been previously reported. ## Subtasks - [ ] Identify all locations in `pyproject.toml` and `requirements*.txt` where `RestrictedPython` is pinned - [ ] Update the `RestrictedPython` dependency constraint to `>=8.0` - [ ] Run `nox -e unit_tests` to verify no regressions from the upgraded version - [ ] Run `nox -e integration_tests` to verify integration tests still pass - [ ] Run `nox` to confirm all quality gates pass with the updated dependency - [ ] Verify the CVEs are no longer flagged by the security scanner ## Definition of Done - [ ] `RestrictedPython` is upgraded to `>=8.0` in all dependency files - [ ] CVE-2024-47532 and CVE-2025-22153 are no longer present in security scan results - [ ] All unit tests pass (`nox -e unit_tests`) - [ ] All integration tests pass (`nox -e integration_tests`) - [ ] All nox stages pass - [ ] Coverage >= 97% > **Backlog note:** This issue was discovered during autonomous operation > on milestone v3.8.0. It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: new-issue-creator
HAL9000 added this to the v3.8.0 milestone 2026-04-09 12:21:11 +00:00
Author
Owner

Label compliance fix applied:

  • Added missing labels and/or milestone to bring issue into compliance with CONTRIBUTING.md

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: backlog-groomer

Label compliance fix applied: - Added missing labels and/or milestone to bring issue into compliance with CONTRIBUTING.md --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: backlog-groomer
Author
Owner

Issue triaged by project owner:

  • State: Verified
  • Priority: High — Security vulnerability in RestrictedPython 7.0. Security vulnerabilities in dependencies are high priority regardless of milestone. RestrictedPython is used for sandboxed code execution, which is a security-critical component.
  • Milestone: Unassigned — Security fixes should be addressed immediately, not tied to a specific milestone.
  • Story Points: 3 — M size. Updating a dependency and verifying no regressions is a 4-8 hour task.
  • MoSCoW: Must Have — Security vulnerabilities in sandboxed execution environments are Must Have fixes. A vulnerability in RestrictedPython could allow sandbox escapes.
  • Parent Epic: Needs linking to the Infrastructure/Security epic.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner

Issue triaged by project owner: - **State**: Verified - **Priority**: High — Security vulnerability in `RestrictedPython 7.0`. Security vulnerabilities in dependencies are high priority regardless of milestone. RestrictedPython is used for sandboxed code execution, which is a security-critical component. - **Milestone**: Unassigned — Security fixes should be addressed immediately, not tied to a specific milestone. - **Story Points**: 3 — M size. Updating a dependency and verifying no regressions is a 4-8 hour task. - **MoSCoW**: Must Have — Security vulnerabilities in sandboxed execution environments are Must Have fixes. A vulnerability in RestrictedPython could allow sandbox escapes. - **Parent Epic**: Needs linking to the Infrastructure/Security epic. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
cleveragents/cleveragents-core#5913
No description provided.