Langroid Sandbox Escape Vulnerability in TableChatAgent and VectorStore Leading to Remote Code Execution

A critical sandbox escape vulnerability allowing remote code execution (RCE) has been identified in Langroid versions prior to 0.65.2. This issue arises in the 'TableChatAgent' and 'VectorStore' capabilities when the agents evaluate LLM-generated tool messages with 'full_eval=True'. The vulnerability exploits an incomplete mitigation in Python's 'eval()' function, where the 'locals' parameter is set to an empty dictionary. This oversight fails to remove 'builtins' from the 'globals' dictionary, allowing access to functions like 'os.system()'. Consequently, an attacker can inject a payload that is executed on the host system, leading to unauthorized actions such as file manipulation or system command execution.

Impact

Exploitation of this vulnerability bypasses application security boundaries, resulting in unauthorized remote code execution on the host system. This could allow an attacker to access databases, exfiltrate data, or compromise the entire system, depending on the privileges of the user running the agent.

Reproduction

To reproduce this vulnerability, install Langroid version 0.65.1 or earlier and configure a 'TableChatAgent' with 'full_eval=True'. Send a prompt that instructs the agent to use the 'pandas_eval' tool, embedding a payload that exploits the 'eval()' mitigation flaw by accessing 'os.system()' to execute a command. The successful execution of the command will indicate that the vulnerability has been exploited.

Remediation

Users can upgrade to Langroid version 0.65.2 or later to address this vulnerability.