In ByteDance verl, the math_equal function in prime_math/grader.py is vulnerable to a sandbox issue; the description indicates that remote attacks are possible. Based on the description, it is inferred that an attacker could potentially escape the sandbox and execute code beyond intended boundaries. This is a privilege escalation vulnerability (CWE‑264 and CWE‑265).

ByteDance verl versions up to 0.7.0 are affected; the vulnerability resides in the prime_math/grader.py module. Any deployment using a 0.7.0 or earlier release must evaluate the risk.

The CVSS score of 6.3 indicates medium severity. The EPSS score of less than 1% suggests a low likelihood of widespread exploitation. However, the existence of a publicly available exploit and the remote nature of the attack raise concerns. It is inferred that the presence of an exploit may lower the effective barrier for skilled adversaries.