CVE-2026-74883

The CVSS 8.8 score attached to this vulnerability badly undersells the risk. What actually happened is simpler and more troubling than the severity metric suggests: a plugin attempted to restrict file operations through a blacklist of specific function names, but that blacklist was never comprehensive. `pathlib.Path` and `io.open` bypass the restriction not because they are obscure edge cases, but because they are first-class pathways to filesystem access that the developers simply did not account for. If you maintain or deploy plugins in this ecosystem, the immediate actions are straightforward. First, confirm whether the patched version (1.4.0) actually addresses `pathlib` and `io.open` — if those are blocked but `os.open`, `os.read`, `os.write`, and `builtins.open` remain accessible, you have not closed the boundary, you've merely shifted the attack surface. Second, treat any plugin that was installed during the vulnerable window as potentially compromised — not because exploitation is certain, but because the sandbox was never a real barrier to begin with. The exposure is architectural, not a single missed function call. The deeper issue is that this failure mode is essentially inevitable with Python. The language offers no first-class primitives for capability-based sandboxing — you cannot声明 'this plugin may access only these specific paths' in any idiomatic way. What developers get instead is a choice between blocking specific names (what happened here, and what will fail again) or not exposing Python at all (which breaks legitimate plugin functionality). The next CVE in this lineage will likely emerge from exactly the pathways this patch doesn't mention. Treat the sandbox as advisory, not enforced — and audit any plugin that claims to need filesystem access for a purpose that isn't explicitly file-handling.

Reviewed through automated stages and approved by a human before publication.