A medium severity vulnerability, CVE-2026-77401 with a CVSS score of 6.8, affects users who allow untrusted individuals to create AccessControl controlled Python code and execute it, potentially leading to critical information disclosure through Python string format and format_map functions. This flaw type exploits the attribute access and subscription mechanism in Python's full blown getattr and getitem functionality, which can be leveraged by an attacker to read objects accessible via recursive attribute access and subscription from accessible objects. The AccessControl package guards against direct access to formatting functions on string instances but does not cover subclasses of str, making all users vulnerable who allow untrusted users to create such code and execute it. Affected versions are AccessControl: < 7.4, which is now patched with version 7.4.
We recommend you to update AccessControl to version 7.4.[/subscribe_to_unlock_form]
A medium severity vulnerability, CVE-2026-77401 with a CVSS score of 6.8, affects users who allow untrusted individuals to create AccessControl controlled Python code and execute it, potentially leading to critical information disclosure through Python string format and format_map functions. This flaw type exploits the attribute access and subscription mechanism in Python's full blown getattr and getitem functionality, which can be leveraged by an attacker to read objects accessible via recursive attribute access and subscription from accessible objects. The AccessControl package guards against direct access to formatting functions on string instances but does not cover subclasses of str, making all users vulnerable who allow untrusted users to create such code and execute it. Affected versions are AccessControl: < 7.4, which is now patched with version 7.4.
We recommend you to update AccessControl to version 7.4.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]