Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr (CVE-2026-34444) | HOL Guard CVE