CPython memory-safety flaw lets malicious AI model templates escape sandboxes
VULNERABILITYredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
RunSybil reported a memory-safety flaw in CPython that lets a malicious chat template in an AI model escape the Jinja sandbox and execute code within inference servers such as vLLM. The demonstration used a backdoored Qwen2.5-0.5B-Instruct model, and the risk is greatest for hosts that let customers upload their own models. The CPython team does not treat sandbox escapes as its security vulnerability, but the fix was merged on 14 August and backported to the 3.13, 3.14 and 3.15 branches as a regular bug fix.
For IT people · Written by AI from 1 source · Wrong?
What to do
- If you run Python 3.13, 3.14 or 3.15, apply the CPython fix that was backported to those branches.
- If you host customer-uploaded models, do not rely on a template sandbox as your only security boundary.
- Plan an upgrade path off Python 3.12, which did not receive the backport.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
CSO Online