Zope AccessControl Vulnerability in Python Code Execution

CVE-2026-77401

What is CVE-2026-77401?

Zope AccessControl, a framework for managing security within Zope applications, has a vulnerability that allows untrusted users to create and execute Python code. This vulnerability arises in implementations prior to version 7.4, where the str.format and str.format_map methods do not adequately secure the execution context when invoked through string subclasses. This oversight enables potentially malicious format strings to access sensitive objects and data through unrestricted attribute access. Consequently, this could lead to information disclosure from the object and methods, making it crucial for users to upgrade to version 7.4 or later to mitigate the risks associated with this vulnerability.

References