GHSA-pq59-9fq7-m886
Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions
Quick fix
GHSA-pq59-9fq7-m886 — accesscontrol: upgrade to the fixed version with the command below.
pip install --upgrade 'accesscontrol>=7.4'Details
### Impact Python's string `format` functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure.
The `AccessControl` package already guards against direct access to the formatting functions on string instances, but these mitigations did not cover subclasses of `str`.
Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it.
### Patches A fix was published with version 7.4.
### Workarounds There is no workaround.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-pq59-9fq7-m886[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-77401[ADVISORY]
- https://github.com/zopefoundation/AccessControl/commit/f980450eea416718be62847f34dfd51822938e43[WEB]
- https://github.com/zopefoundation/AccessControl[PACKAGE]
- https://github.com/zopefoundation/AccessControl/releases/tag/7.4[WEB]