High

LangChain numexpr Evaluate RCE - Interpreter Shell Escape

LangChain's math tools (LLMMathChain, PALChain) can be tricked into passing attacker-controlled text into numexpr's evaluate() function, which can run arbitrary code. This rule catches the moment that code actually spawns an OS command with signs of a real attack, not just the underlying bug.

How the attack works

An attacker gets a malicious expression evaluated through LangChain's math chain, reaching numexpr.evaluate() and triggering CVE-2023-36258. The rule cannot see the evaluation itself, so it instead watches for the resulting damage: the same Python-type process (python, uvicorn, gunicorn, streamlit, chainlit, celery, jupyter) that loaded the numexpr module from disk then spawns a shell command. That command must look like an attack payload — a reverse shell, base64 decode, chmod +x, curl/wget/nc/socat, a pipe into a shell, os.system/__import__ usage, crontab edits, or SSH key tampering. All three signals must trace back to one specific process instance and one time window, from its start to the spawn.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
6f2b9c14-8d3a-4a17-9f5e-2c7b41ad0e93
Severity
High

Why it matters

A successful exploit lets an attacker run arbitrary operating system commands on the server hosting the LangChain application, which can lead to full host compromise, data theft, or lateral movement.

What you can do

  • →Upgrade LangChain and numexpr to versions that patch CVE-2023-36258, or avoid LLMMathChain/PALChain with untrusted input entirely.
  • →Never pass user-supplied or LLM-generated text directly into numexpr.evaluate() or similar dynamic evaluation functions.
  • →Run LangChain math/code chains in a sandboxed or restricted environment with no shell access and minimal OS privileges.
  • →Review alerts carefully in Jupyter/data-science and ETL (Airflow/Celery/Prefect) environments, since analysts and pipelines legitimately shell out to curl, chmod, or base64 there.

Known benign look-alikes

  • Jupyter/IPython data-science sessions where numexpr is loaded transitively via pandas/numpy and the analyst legitimately shells out ("!curl ...", "!chmod +x ..."). This is the single most likely benign match; the rule is report-only for this reason.
  • Airflow/Celery/Prefect Python workers that import numexpr-backed libraries and then run ETL steps through /bin/sh with curl, wget or base64 in the pipeline.
  • Python build or packaging processes (pip wheel builds of numexpr itself) that spawn a shell running chmod +x on freshly compiled artefacts.
  • Security engineers reproducing the CVE-2023-36258 proof-of-concept in a lab.
  • Streamlit/Chainlit demo apps that intentionally expose a shell tool to the operator.

References