RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPython could allow a sandbox escape when a custom import policy or globals exposed the standard library string module, the string.Formatter class, a Formatter instance, or a Formatter subclass to restricted code. The string.Formatter methods format, get_field, get_value, and vformat performed attribute and item traversal internally without passing through RestrictedPython's safer_getattr protections. Restricted code could use those live object references to reach function globals, builtins, file access, or code execution primitives, affecting confidentiality, integrity, and availability in the host environment. This issue is fixed in version 8.4.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - RestrictedPython is a tool that helps define a subset of the Python language for accepting program input
    in a trusted environment. Prior to 8.4, RestrictedPython could allow a sandbox escape when a custom import
    policy or globals exposed the standard library string module, the string.Formatter class, a Formatter
    instance, or a Formatter subclass to restricted code. The string.Formatter methods format, get_field,
    get_value, and vformat performed attribute and item traversal internally without passing through
    RestrictedPython's safer_getattr protections. Restricted code could use those live object references to
    reach function globals, builtins, file access, or code execution primitives, affecting confidentiality,
    integrity, and availability in the host environment. This issue is fixed in version 8.4. (CVE-2026-76825)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - RestrictedPython is a tool that helps define a subset of the Python language for accepting program input     in a trusted environment. Prior to 8.4, RestrictedPython could allow a sandbox escape when a custom import     policy or globals exposed the standard library string module, the string.Formatter class, a Formatter     instance, or a Formatter subclass to restricted code. The string.Formatter methods format, get_field,     get_value, and vformat performed attribute and item traversal internally without passing through     RestrictedPython's safer_getattr protections. Restricted code could use those live object references to     reach function globals, builtins, file access, or code execution primitives, affecting confidentiality,     integrity, and availability in the host environment. This issue is fixed in version 8.4. (CVE-2026-76825)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
462743	Echo: restrictedpython: security update to 8.4	Tenable Cloud Security	Echo Local Security Checks	Local	high
462743	Echo: restrictedpython: security update to 8.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
448153	SCA: security update for RestrictedPython (GHSA-hp3v-5vw7-fx9w)	Tenable Cloud Security	SCA Checks	Local	high
448153	SCA: security update for RestrictedPython (GHSA-hp3v-5vw7-fx9w)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
346941	Linux Distros Unpatched Vulnerability : CVE-2026-76825	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-76825

high

Tenable Plugins

high

high

high

high

high