What is the CVSS score of CVE-2025-22153?

CVE-2025-22153 has a CVSS 3.1 base score of 7.9 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2025-22153?

Organizations using versions of the CPython interpreter starting in 3.11 and face notable risk from CVE-2025-22153 rated CVSS 7.9. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-22153?

Within 30 days: Identify all affected systems running versions of the CPython interpreter starting in 3.11 and and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Python CVE-2025-22153

HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2025-01-23 security-advisories@github.com

Memory Corruption Authentication Bypass Python

7.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.9 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:05 vuln.today

CVE Published

Jan 23, 2025 - 18:15 nvd

HIGH 7.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 pypi packages depend on restrictedpython (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.0.

DescriptionGitHub Advisory

RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using try/except*, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for try/except* clauses. No known workarounds are available.

AnalysisAI

RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Rated high severity (CVSS 7.9), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Access of Resource Using Incompatible Type (Type Confusion) (CWE-843), which allows attackers to execute arbitrary code by exploiting type confusion in the application. RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using try/except*, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for try/except* clauses. No known workarounds are available. Version information: prior to 3.13.2.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Enforce strict type checking, use type-safe languages, validate object types before operations.