Cyber ·
CPython sandbox escape with no backport to security releases
A post on the oss-sec list, dated November 5, 2026, reports a sandbox escape in CPython. The fix was sent as a pull request, but upstream says it will not be backported to security versions, according to the original text.
A post dated November 5, 2026, signed by Alan Coopersmith and distributed on the oss-sec list, reports a sandbox escape in CPython, the reference implementation of Python. The text says the finding could not be reported as a security vulnerability. Instead, a fix was sent as a pull request to the official CPython repository. Upstream notes, however, that this fix will not be backported to security versions, which may leave installations on maintenance branches without the change. A security research company also describes the issue as a threat to the AI supply chain, according to the original material, which is not reproduced here. Technical details of the escape are in the original article and the pull request, not in this summary. To verify, consult the advisory and the pull request directly at the official sources and confirm the Python version you run.