{"version":1,"type":"story","url":"https://digestai.news/story/runsybil-finds-cpython-flaw-enabling-code-execution-via-chat-templates","json":"https://digestai.news/story/runsybil-finds-cpython-flaw-enabling-code-execution-via-chat-templates.json","markdown":"https://digestai.news/story/runsybil-finds-cpython-flaw-enabling-code-execution-via-chat-templates.md","slug":"runsybil-finds-cpython-flaw-enabling-code-execution-via-chat-templates","headline":"RunSybil finds CPython flaw enabling code execution via chat templates","summary":"Cybersecurity firm RunSybil discovered a zero-day vulnerability in the CPython interpreter that allows attackers to escape Python sandboxes, such as Jinja chat templates. By crafting a malicious model file—demonstrated with a backdoored version of Qwen2.5-0.5B-Instruct—an attacker can execute arbitrary code on inference serving engines like vLLM. RunSybil used human effort alongside GPT-5.6 Sol to discover the exploit in under a day.\n\nRunSybil disclosed the issue to CPython, the Pallets Project, and Hugging Face, but reported a lack of coordinated fixes across the supply chain. Python core maintainers reiterated that CPython does not support sandboxing untrusted code as a security boundary, while Jinja maintainers stated the bug lies with CPython. Hugging Face did not respond within the 90-day window, and vLLM acknowledged the report without deciding on a mitigation.\n\nRunSybil submitted a public patch for CPython 3.14, but noted it will not be backported to older versions like Python 3.12, which remains widely used. AWS implemented a mitigation in AWS Bedrock, and DigitalOcean successfully contained the attack through multi-tier isolation.","keyPoints":["RunSybil used GPT-5.6 Sol and human effort to discover a CPython zero-day exploit in less than a day","The vulnerability abuses generic types to escape Jinja chat template sandboxes and execute code on inference engines like vLLM","CPython maintainers state sandboxing untrusted code is not a security boundary, leaving older Python versions unpatched"],"whyItMatters":"The vulnerability exposes AI cloud infrastructure and hosting platforms to remote code execution through malicious model files. Because CPython maintainers do not treat sandbox escapes as security bugs, inference providers relying on software-level Python sandboxes face supply chain risks until 2028 unless they implement multi-tier hardware isolation.","category":{"slug":"policy","name":"Policy & Regulation","url":"https://digestai.news/category/policy"},"entities":{"companies":["RunSybil","Hugging Face","Pallets Project","Amazon Web Services","DigitalOcean"],"models":["GPT-5.6 Sol","Qwen/Qwen2.5-0.5B-Instruct"],"people":[]},"firstPublishedAt":"2026-11-06T00:17:41Z","updatedAt":"2026-11-06T00:17:41Z","sourceCount":1,"hasPrimarySource":false,"sources":[{"outlet":"runsybil.com","title":"CPython 0-Day Vulnerabilities Threaten the AI Supply Chain","url":"https://runsybil.com/blog/cpython-0-day-vulnerabilities-threaten-the-ai-supply-chain","publishedAt":"2026-11-06T00:17:41Z","type":"press","primary":false,"lead":true}],"sourceNotes":null,"discussions":[{"site":"Reddit","url":"https://www.reddit.com/r/LocalLLaMA/comments/1xoyr90/cpython_0day_vulnerabilities_threaten_the_ai/","points":null}],"thread":null,"cite":{"text":"Digest AI, \"RunSybil finds CPython flaw enabling code execution via chat templates\", 6 November 2026, https://digestai.news/story/runsybil-finds-cpython-flaw-enabling-code-execution-via-chat-templates","publisher":"Digest AI","title":"RunSybil finds CPython flaw enabling code execution via chat templates","datePublished":"2026-11-06T00:17:41Z","url":"https://digestai.news/story/runsybil-finds-cpython-flaw-enabling-code-execution-via-chat-templates"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}