RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3…

CVE-2026-55830 is a security vulnerability in RestrictedPython, a tool designed to sandbox Python code execution in trusted environments. The flaw exists in the check_function_argument_names() function, which failed to validate positional-only arguments against protected guard hook names. This omission allowed attackers to shadow critical guard hooks such as __getattr__, _getitem_, _write_, or _print_ using local positional-only parameters. By exploiting this, an attacker could bypass the embedding application's access control and security policy. The vulnerability affects all versions of RestrictedPython prior to 8.3. A fix has been released in version 8.3, which extends the argument name validation to include positional-only arguments. The issue was disclosed via GitHub Security Advisories and patched in a referenced commit to the zopefoundation/RestrictedPython repository.