From 2077da280fca6033a289926efc111993b35a60c9 Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Sat, 8 Aug 2026 11:06:01 +0100 Subject: [PATCH] Python Security Policy: Add note on sandboxes --- security/policy.rst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/security/policy.rst b/security/policy.rst index 14e6bf0652..33228e8e80 100644 --- a/security/policy.rst +++ b/security/policy.rst @@ -33,6 +33,10 @@ and :func:`exec` are documented to execute arbitrary Python code that is supplied as data. The :mod:`ctypes` module is documented to enable modifying arbitrary locations in memory. +CPython does not support sandboxing untrusted Python code as a security +boundary, so escapes from such a sandbox are not vulnerabilities in Python +and should be reported to the sandbox's developers instead. + Vulnerabilities must not depend on malicious control of Python's launch conditions, including (but not limited to) command line arguments, environment variables, or modifications to files on the target system. We assume that, at the time Python