CPython typing-cache memory-safety flaw lets a malicious model chat template escape the Jinja sandbox and run code inside AI inference servers (vLLM)

RunSybil demonstrated (disclosed ~Nov 3-5, 2026, oss-security post Nov 5) that a memory-safety flaw in CPython's generic-type cache lets an attacker who controls a model's Jinja chat template escape the sandbox and execute arbitrary code in the process serving that model — shown against a backdoored Qwen2.5-0.5B checkpoint loaded by vLLM. CPython, Jinja/Pallets, Hugging Face and vLLM were notified; CPython considers sandboxing untrusted Python outside its threat model, and the fix is not backported to the 3.12/3.11 security channel.

This is a model-supply-chain path to code execution on AI inference servers: model weights and their metadata are treated as data, but the chat template is executed as code in the serving process. A poisoned model on Hugging Face becomes a foothold that reaches the inference host and everything it can read (credentials, DB, other models).

A malicious or tampered model checkpoint ships a crafted chat_template.jinja rendered by the server process. The template drives a memory-safety bug in CPython's typing generics cache (an out-of-bounds read via __typing_subst__ on __parameters__) that achieves arbitrary code execution in the serving process with the interpreter's privileges.

CPython (typing generics cache) 3.12/3.11 on Ubuntu/Debian; vLLM and any server rendering model-supplied Jinja chat templates; demonstrated against a backdoored Qwen2.5-0.5B checkpoint.

Treat downloaded chat templates as code — review or ship your own; run inference with least privilege (separate user, no cloud credentials, container without DB reach); move to Python 3.13+ where the fix is backported; do not depend on a distro fix for Python 3.12. There is no CVE and upstream does not plan to backport to the 3.12 security channel, so this is a 'plan as if unfixed' item.