Python Sandbox Escape (pyjail)

Someone wraps eval() in a blacklist, strips __builtins__, and calls it a sandbox. Then a CTF player types a thirty-character object-graph walk and gets a shell. Pyjails lose for one reason: in CPython, every object you’re allowed to touch is a doorway back to everything you’re not.