RestrictedPython's sandbox escapes through a positional-only argument.

CVE-2026-55830 breaks the mechanism the whole library rests on. Sandboxed code is rewritten so attribute access goes through _getattr_, item access through _getitem_, writes through _write_. Argument-name validation rejects those protected names for regular args, *args, **kwargs and keyword-only args, and misses positional-only. So def f(_getattr_=evil, /) makes the hook a local, and every rewritten access calls the attacker's function. Shadowing _print_ additionally captures the internal _getattr_ hook RestrictedPython passes in. Full policy escape from a syntax feature the validator forgot existed. (GitHub Advisory)