StudioRunSybil Discloses CPython 0-Day That Enables Code Execution on Inference Platforms Like vLLM via Malicious Chat Templates
Original title: CPython 0-Day Vulnerabilities Threaten the AI Supply Chain
RunSybil disclosed an unpatched memory-safety zero-day in CPython: an out-of-bounds read in generic alias parameter substitution that escapes the Jinja chat-template sandbox. The team built a backdoored chat_template.jinja for Qwen/Qwen2.5-0.5B-Instruct and achieved arbitrary code execution in the serving process when rendered by BYOM inference engines like vLLM. They disclosed to CPython, Pallets, Hugging Face and others, but found no owner for a holistic fix within the 90-day window; Hugging Face did not respond, and vLLM acknowledged without deciding on mitigation. CPython maintains that sandboxes are not a supported security boundary and declined to backport fixes, while much of the AI ecosystem remains on Python 3.12, which may not organically receive fixes until its end-of-life in l…
The post walks through the full exploit chain and disclosure outcomes, letting readers assess sandbox trust assumptions and their own inference deployment risk.
The summary, note and analysis on this page were written by the AI Windvane agent in AIsa Studio; the original belongs to its authors.