Poisoned chat template escapes the Jinja sandbox through a memory bug in Python itself
Security firm RunSybil shows how a malicious model can run code on servers that host AI models, but no project really wants to own the problem.
Researchers at US security firm RunSybil have found a memory bug in CPython, the reference implementation of Python, that lets an attacker break out of the restricted environment of the Jinja templating language. InfoWorld reports this in an article shared with CSO Online. The flaw is in the code that handles generic types: a bounds check on a list is disabled in normal release builds, allowing Python to read outside its allocated memory.
Many servers that run language models use Jinja to process a model's chat template. RunSybil showed that a modified template in a small Qwen model, loaded into the popular inference software vLLM, could execute arbitrary code. The researchers say the biggest risk lies with providers that let customers upload their own models, since an attacker could then reach other customers' workloads. AWS has introduced a mitigation in Bedrock, according to RunSybil.
The report led to a round of finger-pointing. Python's security team acknowledged the bug and accepted RunSybil's fix for Python 3.13 to 3.15, but does not consider a sandbox escape to be a Python vulnerability. Jinja's maintainers in turn point to Python, and Hugging Face did not respond within the ninety-day window. RunSybil advises treating template systems and sandboxes as an extra layer of protection only, not as a full security boundary.