# LangChain numexpr Evaluate RCE - Interpreter Shell Escape

- **Severity:** High
- **Signature ID:** `6f2b9c14-8d3a-4a17-9f5e-2c7b41ad0e93`
- **CVEs:** CVE-2023-36258

## Summary

LangChain's math tools (LLMMathChain, PALChain) can be tricked into passing attacker-controlled text into numexpr's evaluate() function, which can run arbitrary code. This rule catches the moment that code actually spawns an OS command with signs of a real attack, not just the underlying bug.

## How the attack works

An attacker gets a malicious expression evaluated through LangChain's math chain, reaching numexpr.evaluate() and triggering CVE-2023-36258. The rule cannot see the evaluation itself, so it instead watches for the resulting damage: the same Python-type process (python, uvicorn, gunicorn, streamlit, chainlit, celery, jupyter) that loaded the numexpr module from disk then spawns a shell command. That command must look like an attack payload — a reverse shell, base64 decode, chmod +x, curl/wget/nc/socat, a pipe into a shell, os.system/__import__ usage, crontab edits, or SSH key tampering. All three signals must trace back to one specific process instance and one time window, from its start to the spawn.

## Why it matters

A successful exploit lets an attacker run arbitrary operating system commands on the server hosting the LangChain application, which can lead to full host compromise, data theft, or lateral movement.

## What you can do

- Upgrade LangChain and numexpr to versions that patch CVE-2023-36258, or avoid LLMMathChain/PALChain with untrusted input entirely.
- Never pass user-supplied or LLM-generated text directly into numexpr.evaluate() or similar dynamic evaluation functions.
- Run LangChain math/code chains in a sandboxed or restricted environment with no shell access and minimal OS privileges.
- Review alerts carefully in Jupyter/data-science and ETL (Airflow/Celery/Prefect) environments, since analysts and pipelines legitimately shell out to curl, chmod, or base64 there.

## Known benign look-alikes

- Jupyter/IPython data-science sessions where numexpr is loaded transitively via pandas/numpy and the analyst legitimately shells out ("!curl ...", "!chmod +x ..."). This is the single most likely benign match; the rule is report-only for this reason.
- Airflow/Celery/Prefect Python workers that import numexpr-backed libraries and then run ETL steps through /bin/sh with curl, wget or base64 in the pipeline.
- Python build or packaging processes (pip wheel builds of numexpr itself) that spawn a shell running chmod +x on freshly compiled artefacts.
- Security engineers reproducing the CVE-2023-36258 proof-of-concept in a lab.
- Streamlit/Chainlit demo apps that intentionally expose a shell tool to the operator.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2023-36258
- https://github.com/langchain-ai/langchain/issues/8363
- https://attack.mitre.org/techniques/T1059/006/
- https://owasp.org/Top10/A03_2021-Injection/

---
Source: https://www.netzilo.com/threats/langchain-numexpr-rce-exec