# SuperAGI Output Handler eval() RCE (CVE-2024-21552)

- **Severity:** Critical
- **Signature ID:** `6cb1c33a-5f9d-4c76-9e52-622587b071fe`
- **CVEs:** CVE-2024-21552
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter), AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), ASI06 (Goal and Instruction Manipulation), LLM02 (Sensitive Information Disclosure), LLM05 (Improper Output Handling)

## Summary

SuperAGI, an AI agent framework, has a component that runs Python's eval() on text the LLM produces. If an attacker can get the LLM to output malicious Python code (through prompt injection or a manipulated goal), that code gets executed directly on the server, giving the attacker remote code execution with no authentication needed.

## How the attack works

An attacker crafts input, a prompt, or a manipulated task that causes the agent's LLM to generate output containing Python code, such as calls that spawn processes or touch the filesystem. SuperAGI's output handler code (in output_handler.py) passes this generated content into Python's eval() without validating it first. Because eval() executes arbitrary code, the attacker's payload runs directly on the machine hosting SuperAGI. This affects all versions of SuperAGI since the vulnerable eval() calls are built into the core output-handling logic.

## Why it matters

An attacker gains full code execution on the host running the SuperAGI agent, which can lead to data theft, further lateral movement, or complete takeover of the system running the agent — without needing valid credentials.

## What you can do

- Do not run SuperAGI versions that still call eval() on LLM-generated output; check for a patched release or apply input sanitization to the output handler yourself.
- Restrict what the SuperAGI agent's LLM output can influence — never let raw model output reach an eval(), exec(), or shell call.
- Run agent frameworks like SuperAGI in isolated, low-privilege environments (containers, restricted service accounts) so a code-execution bug can't reach the wider network.
- Monitor agent output logs for Python code patterns (process spawning, file operations, imports) appearing in fields meant for natural-language content.

## Known benign look-alikes

- Legitimate Python educational content discussing eval() safety best practices.
- Static analysis output reporting eval() usage in code review tooling.
- Documentation of CVE-2024-21552 written for defensive purposes.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00432
- https://nvd.nist.gov/vuln/detail/CVE-2024-21552

---
Source: https://www.netzilo.com/threats/atr-superagi-output-handler-eval-rce-cve-2024-21552