Langfun lf.query Eval Injection (Unsandboxed LLM-Generated Code Execution)

Technical Analysis

The lf.query protocol in langfun asks a language model to produce a Python expression as part of its structured output, then evaluates that expression with Python's eval/exec rather than a restricted parser or sandbox. Because the model's output is influenced by attacker-controlled prompt content, an attacker can craft inputs that cause the model to generate expressions containing OS calls, imports, or other dangerous constructs. This is a classic eval injection vulnerability whose entry point is the prompt/model output boundary rather than a traditional user-input field, crossing from the 'model output' trust domain into the 'host application execution' trust domain. Successful exploitation grants the attacker the same privileges as the host process, enabling file access, network calls, or further pivoting within the application or its environment.

Affected Systems

Google langfun

Detection Signatures

• Log entries showing eval()/exec() calls fed directly from LLM completion text in langfun's lf.query execution path
• Unexpected subprocess spawns, file writes, or network connections immediately following a langfun query call
• Prompt inputs containing Python code fragments, import statements, or os/sys/subprocess references intended to be echoed back by the model
• Anomalous LLM outputs containing executable code disguised as structured query results

Remediation Steps

1. 1

   Upgrade langfun

   Update to langfun version 0.1.2 or later, which addresses this eval injection issue.

2. 2

   Remove unsandboxed eval

   Do not evaluate model-generated code with eval()/exec() in production; replace with a restricted expression parser (e.g., AST-based whitelist) or a properly isolated sandbox (containerized, seccomp-restricted subprocess) with no filesystem/network access.

3. 3

   Input/output validation

   Validate and constrain both prompt inputs and model outputs to expected schemas before any downstream evaluation or execution occurs.

4. 4

   Least privilege execution

   Run any code execution component under a minimal-privilege service account/container to limit blast radius if injection succeeds.

5. 5

   Monitor and alert

   Add runtime monitoring for eval/exec calls triggered by LLM output and alert on anomalous subprocess or network activity following model queries.