RunSybil finds CPython flaw enabling code execution via chat templates
Cybersecurity firm RunSybil discovered a zero-day vulnerability in the CPython interpreter that allows attackers to escape Python sandboxes, such as Jinja chat templates. By crafting a malicious model file—demonstrated with a backdoored version of Qwen2.5-0.5B-Instruct—an attacker can execute arbitrary code on inference serving engines like vLLM. RunSybil used human effort alongside GPT-5.6 Sol…
Key points
- RunSybil used GPT-5.6 Sol and human effort to discover a CPython zero-day exploit in less than a day
- The vulnerability abuses generic types to escape Jinja chat template sandboxes and execute code on inference engines like vLLM
- CPython maintainers state sandboxing untrusted code is not a security boundary, leaving older Python versions unpatched
RunSybil disclosed the issue to CPython, the Pallets Project, and Hugging Face, but reported a lack of coordinated fixes across the supply chain. Python core maintainers reiterated that CPython does not support sandboxing untrusted code as a security boundary, while Jinja maintainers stated the bug lies with CPython. Hugging Face did not respond within the 90-day window, and vLLM acknowledged the report without deciding on a mitigation.
RunSybil submitted a public patch for CPython 3.14, but noted it will not be backported to older versions like Python 3.12, which remains widely used. AWS implemented a mitigation in AWS Bedrock, and DigitalOcean successfully contained the attack through multi-tier isolation.
Model page: GPT-5.6 Sol →
CPython 0-Day Vulnerabilities Threaten the AI Supply Chain
runsybil.com · 6 November 2026Loading the full article…
This text was published by runsybil.com and written by Darius Houle. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
Coverage and discussion
1source- Reddit discussionreddit.com
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Policy & Regulation
All →- Microsoft patents AI that could edit live speech and match lips · 2 src
- Republicans ask Nvidia CEO to brief Congress on alleged Chinese spy ties · 1 src
- Google says schools must accept AI features to use Search starting next year · 39 src
- SpaceX shares drop 7% amid AI and tech market sell-off after Democratic midterm wins · 8 src
- OpenAI pledges to avoid NDAs and cover electricity costs for data centers after election backlash · 5 src
Comments
via GitHub Discussions