Langroid TableChatAgent/VectorStore eval() Sandbox Escape RCE

Technical Analysis

The vulnerability stems from a flawed sandboxing attempt in Langroid's TableChatAgent.pandas_eval() and related VectorStore evaluation paths, which call Python's eval() on LLM-generated tool messages with full_eval=True while only clearing the 'locals' dictionary. Because Python's eval() automatically populates '__builtins__' in the globals namespace when not explicitly stripped, the sandbox fails to restrict access to dangerous built-ins such as __import__, allowing constructs like __import__('os').system() to execute arbitrary shell commands. The entry point is any LLM-generated tool call or message content that reaches this eval() sink, meaning an attacker who can influence the LLM's output—through direct prompting, prompt injection via retrieved documents, or poisoned tool responses—can inject a malicious payload that the agent will execute natively on the host. This crosses the boundary from the LLM/model layer into the underlying execution environment, converting an agent's internal tool-execution feature into a direct RCE primitive with no authentication required.

Affected Systems

Langroid

Detection Signatures

• Log entries showing eval() calls with tool messages containing '__import__', 'os.system', 'subprocess', 'exec(', or base64-encoded payloads
• Unexpected child process spawning from the Langroid agent process (e.g., python spawning shell commands)
• TableChatAgent or VectorStore invocations with anomalous pandas_eval() input containing non-tabular/non-numeric expressions
• Outbound network connections or file system writes immediately following LLM tool-call evaluation
• Monitoring for full_eval=True code paths receiving untrusted LLM-generated strings

Remediation Steps

1. 1

   Upgrade Langroid

   Update to Langroid version 0.65.2 or later, which patches the eval() sandbox escape.

2. 2

   Avoid eval() for untrusted code execution

   Replace eval()-based evaluation of LLM-generated tool messages with a properly restricted execution environment (e.g., using ast.literal_eval for data-only inputs, or a vetted sandboxing library that explicitly strips __builtins__).

3. 3

   Sandbox agent execution environment

   Run TableChatAgent/VectorStore-enabled agents in isolated containers or VMs with minimal privileges, no network egress, and restricted filesystem access to limit blast radius if code execution occurs.

4. 4

   Input validation and allow-listing

   Enforce strict schema and content validation on LLM-generated tool call payloads before they reach any evaluation function, rejecting anything resembling code execution primitives.

5. 5

   Audit for full_eval usage

   Search codebases for full_eval=True usage and review all downstream eval() calls for similar sandboxing flaws, applying explicit __builtins__ removal or safer alternatives.