CPython memory-safety flaw lets malicious AI model templates escape sandboxes
- Severity
- Medium
- Sources
- 1
What happened
RunSybil (Darius Houle) reports a CPython memory-safety bug in generic type handling: a cached parameter list goes stale after a callback modifies an object, yielding an out-of-bounds index that an assertion catches only in debug builds. This was chained with Jinja sandbox objects to leak live object references and achieve code execution via a backdoored chattemplate.jinja in a Qwen2.5-0.5B-Instruct model served through vLLM. No CVE is mentioned. The PSRT says sandbox escapes are out of scope, though the fix merged to main on 14 August was backported to 3.13, 3.14 and 3.15 as a non-security bug fix, with no 3.12 backport. Treat sandboxed templates and expression evaluators as best-effort controls, and do not run untrusted bring-your-own-model templates without isolation.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- If you run Python 3.13, 3.14 or 3.15, apply the CPython fix that was backported to those branches.
- If you host customer-uploaded models, do not rely on a template sandbox as your only security boundary.
- Plan an upgrade path off Python 3.12, which did not receive the backport.
Written by AI from the sources, checked against them