---
title: RunSybil: a CPython generic-alias memory bug lets a crafted Jinja chat template escape the sandbox and run code in LLM inference hosts; CPython won't treat it as a security fix | ctxsec
url: https://ctxsec.com/items/runsybil-cpython-generic-alias-sandbox-escape-jinja-chat-templates
description: "RunSybil reports that crafted objects with __typing_subst__ / __typing_prepare_subst__ hooks can make CPython's generic-alias parameter substitution read argitems[-1] (assert compiled out in release builds), turning a manufactured tuple hash into a live object pointer and then into arbitrary code execution inside Jinja sandboxes used for LLM chat templates. They demonstrated a backdoored Qwen chat_template.jinja executing in a vLLM serving process. CPython reiterated that it does not support sandboxing untrusted Python as a security boundary; Jinja told them to report it to CPython; Hugging Face did not respond in 90 days; vLLM acknowledged without a decided mitigation. RunSybil submitted a public CPython PR that is not being backported to security releases. They say DigitalOcean's BYOM isolation contained the attack and AWS Bedrock shipped a mitigation."
status: "confirmed research (RunSybil, Nov 3) plus oss-security discussion Nov 5; CPython does not treat sandbox escapes as Python vulnerabilities"
published: 2026-11-05
---

> RunSybil reports that crafted objects with __typing_subst__ / __typing_prepare_subst__ hooks can make CPython's generic-alias parameter substitution read argitems[-1] (assert compiled out in release builds), turning a manufactured tuple hash into a live object pointer and then into arbitrary code execution inside Jinja sandboxes used for LLM chat templates. They demonstrated a backdoored Qwen chat_template.jinja executing in a vLLM serving process. CPython reiterated that it does not support sandboxing untrusted Python as a security boundary; Jinja told them to report it to CPython; Hugging Face did not respond in 90 days; vLLM acknowledged without a decided mitigation. RunSybil submitted a public CPython PR that is not being backported to security releases. They say DigitalOcean's BYOM isolation contained the attack and AWS Bedrock shipped a mitigation.

[← AI](/ai) · [markdown](/items/runsybil-cpython-generic-alias-sandbox-escape-jinja-chat-templates.md)

confirmed research (RunSybil, Nov 3) plus oss-security discussion Nov 5; CPython does not treat sandbox escapes as Python vulnerabilities

2026-11-05

### RunSybil: a CPython generic-alias memory bug lets a crafted Jinja chat template escape the sandbox and run code in LLM inference hosts; CPython won't treat it as a security fix

- **Who should care:** anyone who renders untrusted model chat templates or other untrusted Jinja/Python under a 'sandbox' on a shared inference host (BYOM platforms, internal model hubs, agent runtimes that evaluate model-supplied templates).
- **Practical stance:** treat those sandboxes as best-effort, not a security boundary. Isolate BYOM / untrusted-template rendering in a disposable VM/container with no cloud credentials, and don't load chat templates from models you haven't reviewed.
- **Patch reality:** the memory bug may land in newer CPython only; large parts of the AI stack still on 3.12 will not get a security-backport of this class of fix. Defense is isolation and template allow-lists, not waiting for a CVE labeled against CPython.

Sources: [RunSybil: CPython 0-Day Vulnerabilities Threaten the AI Supply Chain (Nov 3)](https://www.runsybil.com/blog/cpython-0-day-vulnerabilities-threaten-the-ai-supply-chain) · [oss-security: CPython sandbox escape (Alan Coopersmith, Nov 5)](https://seclists.org/oss-sec/2026/q4/530) · [CPython PR 155761 (public patch submission)](https://github.com/python/cpython/pull/155761)