Remote Code Execution via Script (Python) objects under Python 3
Description
Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional Products.PythonScripts add-on package installed. By default, one must have the admin-level Zope "Manager" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web are at risk. Zope releases 4.6.3 and 5.3 are not vulnerable. As a workaround, a site administrator can restrict adding/editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ZopePyPI | >= 4.0, < 4.6.3 | 4.6.3 |
ZopePyPI | >= 5.0, < 5.3 | 5.3 |
Affected products
1- Range: >= 4.0, < 4.6.3
Patches
2869f947e5865Merge pull request from GHSA-g4gq-j4p2-j8fr
5 files changed · +8 −4
CHANGES.rst+4 −0 modified@@ -10,6 +10,10 @@ https://zope.readthedocs.io/en/2.13/CHANGES.html 4.6.3 (unreleased) ------------------ +- Update the ``AccessControl`` version pin to fix a remote code execution issue + (see `AccessControl security advisory GHSA-qcx9-j53g-ccgf + <https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf>`_) + - Prevent ``DeprecationWarnings`` from moved imports in ``AccessControl`` - make sure "Manager" users can always modify proxy roles
constraints.txt+1 −1 modified@@ -1,4 +1,4 @@ -AccessControl==4.2 +AccessControl==4.3 Acquisition==4.7 AuthEncoding==4.2.1 BTrees==4.9.2
requirements-full.txt+1 −1 modified@@ -1,5 +1,5 @@ Zope==<5 -AccessControl==4.2 +AccessControl==4.3 Acquisition==4.7 AuthEncoding==4.2.1 BTrees==4.9.2
setup.py+1 −1 modified@@ -70,7 +70,7 @@ def _read_file(filename): package_dir={'': 'src'}, python_requires='>=2.7,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,<3.9', install_requires=[ - 'AccessControl >= 4.2', + 'AccessControl >= 4.3, <5.0', 'Acquisition', 'BTrees', 'Chameleon >= 3.7.0',
versions-prod.cfg+1 −1 modified@@ -5,7 +5,7 @@ Zope = <5 Zope2 = 4.0 # AccessControl 5+ no longer supports Zope 4. -AccessControl = 4.2 +AccessControl = 4.3 Acquisition = 4.7 AuthEncoding = 4.2.1 BTrees = 4.9.2
f72a18dda8e9Merge pull request from GHSA-g4gq-j4p2-j8fr
5 files changed · +8 −4
CHANGES.rst+4 −0 modified@@ -11,6 +11,10 @@ https://github.com/zopefoundation/Zope/blob/4.x/CHANGES.rst 5.3 (unreleased) ---------------- +- Update the ``AccessControl`` version pin to fix a remote code execution issue + (see `AccessControl security advisory GHSA-qcx9-j53g-ccgf + <https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf>`_) + - Prevent ``DeprecationWarnings`` from moved imports in ``AccessControl`` - make sure "Manager" users can always modify proxy roles
constraints.txt+1 −1 modified@@ -1,4 +1,4 @@ -AccessControl==5.0 +AccessControl==5.2 Acquisition==4.7 AuthEncoding==4.2.1 BTrees==4.9.1
requirements-full.txt+1 −1 modified@@ -1,5 +1,5 @@ -e git+https://github.com/zopefoundation/Zope.git@master#egg=Zope -AccessControl==5.0 +AccessControl==5.2 Acquisition==4.7 AuthEncoding==4.2.1 BTrees==4.9.1
setup.py+1 −1 modified@@ -69,7 +69,7 @@ def _read_file(filename): package_dir={'': 'src'}, python_requires='>= 3.6', install_requires=[ - 'AccessControl >= 4.2', + 'AccessControl >= 5.2', 'Acquisition', 'BTrees', 'Chameleon >= 3.7.0',
versions-prod.cfg+1 −1 modified@@ -4,7 +4,7 @@ [versions] Zope = Zope2 = 4.0 -AccessControl = 5.0 +AccessControl = 5.2 Acquisition = 4.7 AuthEncoding = 4.2.1 BTrees = 4.9.1
Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
7- github.com/advisories/GHSA-g4gq-j4p2-j8frghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-32811ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2021-368.yamlghsaWEB
- github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgfghsax_refsource_MISCWEB
- github.com/zopefoundation/Zope/commit/869f947e586517566509e0ccdd4d99b60704cc02ghsaWEB
- github.com/zopefoundation/Zope/commit/f72a18dda8e9bf2aedb46168761668464a4be988ghsax_refsource_MISCWEB
- github.com/zopefoundation/Zope/security/advisories/GHSA-g4gq-j4p2-j8frghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.