Read the docs
TI-2023-21676 Aliases CVE-2023-41050GHSA-8xv7-89vj-q48c

Information disclosure through Python's "format" functionality in Zope AccessControl

Priority LOW 35CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure. `AccessControl` already provides a safe variant for `str.format` and denies access to `string.Formatter`. However, `str.format_map` is still unsafe. Affected are all users who allow untrusted users to create `AccessControl` controlled Python code and execute it. A fix has been introduced in versions 4.4, 5.8 and 6.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00641 50th percentileScored 2026-11-07
Fix Fixed AccessControl (PyPI): 4.4, 5.8, 6.2Zope (PyPI): 4.8.9, 5.8.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zopefoundationAccessControlAccessControl: < 4.4; AccessControl: >= 5.0, < 5.8; AccessControl: >= 6.0, < 6.2; Zope: < 4.8.9; Zope: >= 5.0.0, < 5.8.4—No fix listedCNA
—AccessControl (PyPI)before 4.44.4Patch availableGHSA-8xv7-89vj-q48c
—Zope (PyPI)before 4.8.94.8.9Patch availableGHSA-8xv7-89vj-q48c
—AccessControl (PyPI)5.0 to before 5.85.8Patch availableGHSA-8xv7-89vj-q48c
—AccessControl (PyPI)6.0 to before 6.26.2Patch availableGHSA-8xv7-89vj-q48c
—Zope (PyPI)5.0.0 to before 5.8.45.8.4Patch availableGHSA-8xv7-89vj-q48c
  • AccessControl Vendorzopefoundation Affected AccessControl: < 4.4; AccessControl: >= 5.0, < 5.8; AccessControl: >= 6.0, < 6.2; Zope: < 4.8.9; Zope: >= 5.0.0, < 5.8.4 Fixed in — No fix listed CNA
  • AccessControl (PyPI) Vendor— Affected before 4.4 Fixed in 4.4 Patch available GHSA-8xv7-89vj-q48c
  • Zope (PyPI) Vendor— Affected before 4.8.9 Fixed in 4.8.9 Patch available GHSA-8xv7-89vj-q48c
  • AccessControl (PyPI) Vendor— Affected 5.0 to before 5.8 Fixed in 5.8 Patch available GHSA-8xv7-89vj-q48c
  • AccessControl (PyPI) Vendor— Affected 6.0 to before 6.2 Fixed in 6.2 Patch available GHSA-8xv7-89vj-q48c
  • Zope (PyPI) Vendor— Affected 5.0.0 to before 5.8.4 Fixed in 5.8.4 Patch available GHSA-8xv7-89vj-q48c

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:zope:accesscontrol:*:*:*:*:*:*:*:*before 4.4; 5.0 to before 5.8; 6.0 to before 6.2Vulnerablezopefoundation
cpe:2.3:a:zope:zope:*:*:*:*:*:*:*:*before 4.8.9; 5.0 to before 5.8.4Vulnerablezopefoundation
  • cpe:2.3:a:zope:accesscontrol:*:*:*:*:*:*:*:* Versions before 4.4; 5.0 to before 5.8; 6.0 to before 6.2 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:*:*:*:*:*:*:*:* Versions before 4.8.9; 5.0 to before 5.8.4 Vulnerable ·zopefoundation

Remediation

  • Fix · GHSA-8xv7-89vj-q48c AccessControl (PyPI) Fixed in 4.4 Advisory →
  • Fix · GHSA-8xv7-89vj-q48c Zope (PyPI) Fixed in 4.8.9 Advisory →
  • Fix · GHSA-8xv7-89vj-q48c AccessControl (PyPI) Fixed in 5.8 Advisory →
  • Fix · GHSA-8xv7-89vj-q48c AccessControl (PyPI) Fixed in 6.2 Advisory →
  • Fix · GHSA-8xv7-89vj-q48c Zope (PyPI) Fixed in 5.8.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-41050
  2. 2026-10-03 Alias added: GHSA-8xv7-89vj-q48c
  3. 2026-10-23 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 1

  • TI-2021-12476 Remote Code Execution via Script (Python) objects under Python 3 CVSS 3.1HIGH 7.5
  • TI-2021-12472 Remote Code Execution via unsafe classes in otherwise permitted modules CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences