langfun Lf.query executes model output via exec() (CWE-94/95) PoC

Vulnerability Summary: langfun Default Lf.query Executes Model Output via exec() (CWE-94/95) Vulnerability Overview Vulnerability ID: #725 (CWE-94/95) Core Issue: In the default protocol ( ), executes Python expressions returned by the model using with . Root Cause: In the default configuration, , and the AST permission filter restricts node types but not node content, allowing an attacker to execute arbitrary Python expressions as side effects via prompt injection. Silent Execution: There are no logs or exceptions, making it invisible to developers. Scope of Impact Affected Versions: - PyPI 0.1.1 (latest release; full history 0.0.1 / 0.1 / 0.1.1) — Confirmed - @ e08939c — Confirmed - Hardening for this path exists only in (the single structured parser commit in 0.1.1 predates , where the file was moved to ) Default values for argument-less calls: - , , (value 9) - — Protocol defaults to - — - — Permission defaults to Call Chain (Public API → exec()): and have the same risk under the same default values. Minimal Reproduction (POC Code) > Reproduction Notes: The "model output" is provided directly via a mocked LLM—no network, no API key required. The entire model response is a single expression that looks like an ordinary schema literal. > Verification Note: Verify via the filesystem (not print). wraps within (pyglove.execution.py:184), so print statements do not display any content when the code executes. Why the AST Filter Cannot Prevent It The filter allows and all expression nodes, but does not restrict which callable objects can be invoked. CPython automatically adds to the global scope of ; and others are reachable by name (confirmed). Removing is not a complete fix— auto-attributes, and schema code classes plus remain reachable via any node. This filter restricts node types, not node content; it is unreliable as a code execution boundary. Threat Model Applications based on langfun (RAG, agents, scoped pools) that expose prompt content to attackers—such as ingested documents, user messages, scoped pools, and tool results. Prompt injection allows attackers to control the expression, executing arbitrary code within the application process, inheriting the application’s permissions (keys, filesystem, outbound network). Triggerrable without host access, schema knowledge, or non-default configurations. Remediation (by priority) 1. Replace the exec-based parser with a literal/schema-aware evaluator: An -style evaluator that allows only schema-declared types (e.g., , , , ). Legitimate structured output responses are always literals or test schema values; they should not be able to create or . This eliminates the risk entirely. 2. Inherit hardening: Default in , relying fully on sandbox context creation. 3. Document the behavior: Explain in the documentation and README "Security Model" section for / / that the Python protocol executes model output, and recommend non-default configurations. > Note: The non-default path in the JSON protocol is not a safe alternative—it routes to ( ) in pyglove, imports the attacker's namespaced modules, and runs . This is a security concern belonging to upstream . Do not recommend "switching the default to JSON" as a fix.

Goal Reached Thanks to every supporter — we hit 100%!

langfun Lf.query executes model output via exec() (CWE-94/95) PoC

More from this source