# Shell Evasion Eval and Language-Level Exec Injection

- **Severity:** High
- **Signature ID:** `f5e34339-927a-424d-8159-ceb736195873`
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** ASI03 (Identity and Impersonation), LLM06 (Excessive Agency)

## Summary

Some security filters only look for shell symbols like $() or backticks to catch command injection. This detection covers attackers who dodge those filters by using programming-language functions like eval() and exec() to run arbitrary commands instead, since those functions execute code without ever needing the flagged symbols.

## How the attack works

An attacker aiming to run an unauthorized command tries a straightforward shell injection first, using metacharacters like backticks or $(), and finds it blocked by a filter watching for those symbols. Instead, they submit input built around language-level execution functions: Ruby's eval("...") or Kernel.exec("..."), Python's eval()/exec()/os.system(), JavaScript's eval() or the Function() constructor, or a shell's own eval statement. These constructs let the interpreter run the payload directly, producing the same arbitrary command execution as the blocked shell syntax but without tripping a filter that only checks for shell metacharacters. The result is command or code execution smuggled through a legitimate-looking interpreter call.

## Why it matters

An organization can lose control over what code or commands run inside an AI agent's environment, letting an attacker execute arbitrary logic, read or modify data, or pivot further, all while evading filters that only screen for shell syntax.

## What you can do

- Do not rely solely on shell-metacharacter filtering; treat eval/exec/Function-constructor calls in any language as a control point requiring their own review or blocking policy.
- Restrict or disable dynamic code execution functions (eval, exec, os.system, Function()) in agent-facing code paths unless explicitly required.
- Log and review any agent-generated code or commands that invoke eval/exec-style constructs before execution, especially when input originates from untrusted or user-supplied content.
- Run agents with least-privilege execution environments so that even if eval/exec injection succeeds, the blast radius is limited.

## Known benign look-alikes

- Code review agents analyzing eval usage in Python/Ruby codebases
- Educational content about eval injection vulnerabilities
- Legitimate dynamic code generation in authorized sandboxed environments

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01611

---
Source: https://www.netzilo.com/threats/atr-shell-evasion-eval-and-language-level-exec-injection