A bug in the Python interpreter lets a tampered language model break out of the Jinja sandbox
RunSybil researchers ran code on a model-serving machine through a forged chat template, but the Python security team does not see a CPython vulnerability.
Security firm RunSybil has used a memory bug in CPython, the standard implementation of Python, to get around the protected environment of the Jinja template language. According to CSO Online and InfoWorld, the problem lies in how Python caches generic types. After a change made through a callback, an invalid index can be returned, and a check that would catch this is switched off in regular releases. That lets code reach objects the sandbox was supposed to hide.
To demonstrate the risk, the researchers modified the small Qwen2.5-0.5B-Instruct model with a forged chat template. When that model was loaded through an inference server such as vLLM, the attacker could run their own code in the server process. That is mainly a danger for providers that let customers upload their own models, since an attacker could reach infrastructure belonging to other customers.
A fix has been in CPython's main branch since 14 August and, according to FOSS Linux, was carried over to Python 3.13 and 3.14 on 8 September, but as an ordinary bug fix rather than a security update. There is no public fix for Python 3.12, which ships with Ubuntu 24.04 among others. The Python Security Response Team acknowledges the bug but argues that escaping a sandbox is a matter for the makers of that sandbox. The Pallets Project, which maintains Jinja, in turn sent the researchers back to CPython. RunSybil advises providers not to treat templates and sandboxes as a full security boundary.