CVE-2025-22153: try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter

January 23, 2025

Via a type confusion bug in the CPython interpreter when using try/except* RestrictedPython could be bypassed.

We believe this should be fixed upstream in Python itself until that we remove support for try/except* from RestrictedPython. (It has been fixed for some Python versions.)

References

github.com/advisories/GHSA-gmj9-h825-chq2
github.com/zopefoundation/RestrictedPython
github.com/zopefoundation/RestrictedPython/commit/48a92c5bb617a647cffd0dadd4d5cfe626bcdb2f
github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-gmj9-h825-chq2
nvd.nist.gov/vuln/detail/CVE-2025-22153

Code Behaviors & Features

Detect and mitigate CVE-2025-22153 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →