Unauthenticated RCE in InternLM MindSearch POST /solve

Vulnerability Overview Vulnerability Name: Unauthenticated Unsandboxed Remote Code Execution in InternLM MindSearch (POST /solve) Vulnerability Type: Unauthenticated Remote Code Execution (RCE) Vulnerability Description: MindSearch exposes an unauthenticated FastAPI endpoint . Upon receiving a request, this endpoint extracts Python code blocks from the model's response and passes them to for execution, with no sandbox, AST whitelisting, or authentication mechanisms in place. It binds to by default, allowing any attacker with access to this endpoint to achieve root-level code execution within the server process by crafting malicious payloads. Vulnerability Severity: CVSS 3.1: 9.8 Critical CVSS 4.0: 9.3 Critical Affected Products: InternLM MindSearch (all public versions, including main branch commit 7952c5f and earlier as of 2026-08-22) Report Status: Coordinated disclosure with CVE assignment --- Impact Scope Attack Conditions: - The attacker must be able to TCP-access the endpoint (default ) - No authentication, cookies, or passwords are required - Requires a planning LLM capable of outputting code blocks (e.g., InternLM2.5-chat, GPT, DeepSeek-V4-Flash, etc.) Impact Consequences: - Execution of arbitrary system commands with root privileges - Reading process environment variables (OPENAI_API_KEY, WEB_SEARCH_API_KEY, cloud keys, etc.) - Reading and writing host or container files - Reverse shell / backdoor installation - Acting as an SSRF/proxy to attack internal networks - Leveraging CORS configuration ( ) to achieve cross-site drive-by attacks --- Remediation 1. Authentication and Binding Restrictions: - Add an authentication mechanism to - Bind to unless API exposure is explicitly required; do not publish port 8002 on by default 2. Prohibit Direct Execution of Model Output: - Do not use to execute model outputs - Only allow structured operations (whitelisted method names + type parameters) 3. Isolated Execution Environment: - If a code interpreter is absolutely necessary, use a separate unprivileged container - Do not store secrets in environment variables - No outbound network access, no seccomp, no timeout, no root privileges 4. Parsing Optimization: - Parse only the interpreter action blocks, rather than the first code block in the entire message 5. Return Type Correction: - Stop returning the result to the client --- POC Code First line of the interpreter block returned by the model: Post-execution host proof: --- > Note: This vulnerability does not require a preceding bug, nor is it a "forgot to set default password" issue; it is fundamentally a missing authentication module.

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated RCE in InternLM MindSearch POST /solve