CVE-2026-55830: RestrictedPython guard hooks can be shadowed via positional-only arguments

RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes _getattr_(obj, name), item access becomes _getitem_(obj, key), writes go through _write_, and print goes through _print_. The embedding application supplies these hooks to enforce its policy.

Argument-name validation rejects these protected names for regular arguments, *args, **kwargs, and keyword-only arguments, but it misses positional-only arguments (the ones before /). So a function like:

def f(_getattr_=evil, /):
return o.x

makes _getattr_ a local that shadows the policy hook, and the rewritten access calls evil instead. The same works for _getitem_, _write_, and _print_. Shadowing _print_ can also be used to capture the internal _getattr_ hook that RestrictedPython passes in.

The result is that sandboxed code can bypass the access policy the embedding application relies on. In applications that also handle sandbox-controlled objects unsafely (for example serializing them with pickle), this primitive can be chained further, up to remote code execution. That part depends on the embedding application, but the underlying guard bypass is in RestrictedPython.