Python Sandbox Escape via Dunder Method Invocation

A Deep Analysis of CVE-2025-9959 - Python Sandbox Escape via Dunder Attribute Validation Bypass in Smolagents

This security research document presents a comprehensive analysis of a sandbox escape vulnerability discovered in the HuggingFace smolagents library. The vulnerability, addressed in Pull Request #1551, allowed attackers to bypass Python interpreter sandboxing through dunder (double underscore) method invocation. This document provides an in-depth technical examination of the vulnerability, gadget chain construction methodology, exploitation techniques, and the implemented mitigation strategies.

1. Introduction and Background

1.1 Research Context

The smolagents library, developed by HuggingFace, provides a framework for building AI agents capable of executing Python code. A critical component of this framework is the LocalPythonExecutor, which implements a sandboxed Python interpreter designed to safely execute untrusted code generated by language models.

Sandbox implementations in Python face inherent challenges due to the language’s dynamic nature and extensive introspection capabilities. The vulnerability examined in this research demonstrates how subtle implementation gaps can lead to complete sandbox compromise.

1.2 Vulnerability Overview

1.3 Document Scope

This research covers:

• Technical analysis of Python’s object model as it relates to sandbox escapes

• Detailed vulnerability root cause analysis

• Gadget chain identification and construction methodology

• Working proof-of-concept exploitation

• Mitigation effectiveness evaluation

---

2. Python Object Model Fundamentals

2.1 Object Hierarchy in Python

Understanding Python’s object model is essential for comprehending how sandbox escapes function. Every object in Python exists within a class hierarchy that ultimately derives from the base object class.

The following code demonstrates traversing this hierarchy:

obj = ()
print(f'Object: {obj}')
print(f'Type: {type(obj)}')
print(f'Class: {obj.__class__}')
print(f'Bases: {obj.__class__.__bases__}')
print(f'Object base: {obj.__class__.__bases__[0]}')
print(f'Subclasses count: {len(object.__subclasses__())}')

Execution Output:

2.2 Dunder Methods and Attributes

Python uses double underscore (dunder) naming convention for special methods and attributes that control fundamental object behavior: