It suffers from a GIL to prevent race conditions in the data structures of the interpreter, which is written in C. C extensions add to the problem. I'm not sure that this kind of languages can be classified as memory safe. Maybe JRuby, which runs on the JVM.
Anyway, even without C extensions a malicious input might trigger a memory related vulnerability in the interpreter. A compiled program written in a memory safe language could suffer from a compiler bug. Did it happen to Go and Rust?