CVE-2026-77401

### Impact Python's string `format` functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure. The `AccessControl` package already guards against direct access to the formatting functions on string instances, but these mitigations did not cover subclasses of `str`. Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it. ### Patches A fix was published with version 7.4. ### Workarounds There is no workaround.