CVE-2026-74886: Python Sandbox Desynced Import Denylistcve-2026-74886-python-sandbox-desynced-import-denylist
Hardcoded sandbox import deny-list does not block the file-access modules 'io'/'pathlib' (and 'os'). Sandboxed file access is typically enforced only by replacing builtins.open, so io.open() and pathlib.Path.* calls reach the real C-level open and bypass the sandbox, while a hand-maintained list drifts out of sync with the static analyzer's blocked-module li
