The Morning Dev

Only the news worth knowing

‹
 
C21/100

Vulnerability · medium

CPython sandbox escape vulnerability reported

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: CPython users relying on its sandboxing for untrusted code

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

Popular tool

The Brief

  • Runsybil reported a sandbox escape vulnerability in CPython, according to an oss-security post by Alan Coopersmith dated 2026-11-05.
  • The post says the reporter was not successful in getting the issue reported as a security issue; full details are only in the linked Runsybil blog post.
  • Sam James replied to the thread on the same day with a link to an unrelated LWN article; the sources give no severity, affected versions, or fix.

Why it matters

Sandbox escapes can let code break out of restricted Python execution, so teams that rely on CPython sandboxing for untrusted code should watch for an advisory and fix. The sources do not yet confirm which versions are affected.

The checklist behind the tier

Checklist · 2 of 10 yes
YesHits tech teamsCPython is a runtime developers build and run software with, so it is in scope.
NoCore infrastructureCPython is widely used but is not foundational like OpenSSH, the Linux kernel or OpenSSL.
YesPopular toolCPython is the reference Python interpreter, used by a very large number of teams.
NoExploited in the wildOpen Source Security posts describe a found sandbox escape; no source reports observed attacks.
NoPublic exploitOpen Source Security: the blog gives full details at a URL; no source says exploit code is published.
NoRemote, no loginOpen Source Security sources do not state the attack vector or whether authentication is needed.
NoFull takeoverOpen Source Security calls it a sandbox escape but does not state code execution or root/admin impact.
NoSecrets exposedOpen Source Security sources report no stolen credentials, tokens, keys, configs or data.
NoSupply chainOpen Source Security sources report no compromised package, update, build pipeline or signing key.
NoNo fix yetOpen Source Security: reporters were not successful in reporting it as a security issue; no fix status is stated.

Timeline

  1. CPython sandbox escape reported on the oss-security list by Alan Coopersmith

  2. Open Source Security

    CPython sandbox escape · +1 reply

Full coverage · 2 sources

First seen · 2 sources · Full story page · How tiers are decided