CVE-2026-76825: RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution

RestrictedPython could allow a sandbox escape when a policy exposes the standard library string module, or otherwise exposes string.Formatter, to restricted code.

string.Formatter field resolution methods such as get_field can perform attribute and item traversal internally and return live object references. This can bypass RestrictedPython’s normal attribute guards and may allow access to sensitive objects such as function globals, builtins, file access, or code execution primitives.

Users are impacted if they run untrusted code with RestrictedPython and expose string.Formatter, directly or indirectly, for example through a custom import policy or globals.