{"id":"CVE-2025-22153","aliases":["GHSA-gmj9-h825-chq2","PYSEC-2026-1874"],"title":"try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter","summary":"try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter","severity":"high","cvss":7.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","vendor":"restrictedpython","product":"restrictedpython","ecosystem":"pip","affected":["restrictedpython >= 6.0, < 8.0"],"patched":["restrictedpython 8.0"],"published":"2025-01-23","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-gmj9-h825-chq2","references":[{"url":"https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-gmj9-h825-chq2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22153"},{"url":"https://github.com/zopefoundation/RestrictedPython/commit/48a92c5bb617a647cffd0dadd4d5cfe626bcdb2f"},{"url":"https://github.com/zopefoundation/RestrictedPython"}],"tags":["osv","pip"],"epss":0.00402,"epssPercentile":0.34186,"ingestedAt":"2026-07-08T18:25:49.742Z","slug":"CVE-2025-22153","body":"## Overview\n\n### Impact\nVia a type confusion bug in the CPython interpreter when using `try/except*` RestrictedPython could be bypassed.\n\nWe believe this should be fixed upstream in Python itself until that we remove support for `try/except*` from RestrictedPython.\n(It has been fixed for some Python versions.)\n\n### Patches\nPatched in version 8.0 by removing support for `try/except*` clauses\n\n### Workarounds\nThere is no workaround.\n\n### References\nnone\n\n\n## Affected packages\n\n- `restrictedpython >= 6.0, < 8.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `restrictedpython 8.0`","depth":"twilight","depthScore":44,"depthScoreParts":{"impact":43.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}