LangChain PAL Chain Arbitrary Code Execution
Older versions of LangChain's PALChain feature turn user-supplied text into Python code and run it without any safety sandbox. An attacker who can influence the question sent to the chain can smuggle in commands that execute on the server running the agent.
How the attack works
An attacker submits a specially crafted question to a LangChain agent using PALChain's from_math_prompt or from_colored_object_prompt helpers. PALChain converts the question into a Python program and executes it directly, with no sandboxing. If the attacker's input contains code like an os.system call or a Python exec/eval, that code runs with the same privileges as the agent process. This is detected by looking for command lines that combine a reference to the vulnerable PALChain API (or its generated 'def solution():' code skeleton) together with a concrete code-execution primitive such as os.system, subprocess, eval, or exec in the same inline python -c invocation.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c1f4a92-3d6b-4e8a-9b5c-0af2d7e61b34
- Severity
- High
Why it matters
Successful exploitation gives the attacker arbitrary code execution on the machine hosting the LangChain agent, at whatever privilege level that process runs with — potentially leading to data theft, lateral movement, or full host compromise.
What you can do
- →Upgrade LangChain (and langchain_experimental) to a version at or above 0.0.236, where this PAL Chain sandbox issue is fixed.
- →Avoid using PALChain's from_math_prompt or from_colored_object_prompt with any input derived from untrusted users.
- →If PALChain must be used, isolate its execution in a locked-down sandbox or container with no network and minimal filesystem access.
- →Review logs for python -c invocations that reference PALChain or the 'def solution():' pattern alongside os.system, subprocess, eval, or exec calls.
Known benign look-alikes
- Security researchers or red teams reproducing the documented CVE-2023-36258 proof of concept (`PALChain.from_math_prompt` with an `import os; os.system(...)` question) on a pinned vulnerable LangChain build. This is a true positive for the pattern and an intentional report.
- LangChain maintainers or a dependency-upgrade agent running the langchain_experimental PAL test suite — suppressed when the process is launched through pytest/tox/nox.
- A developer grepping the repository or reading a security advisory that quotes the vulnerable function names — suppressed by the leading-binary code-search filter.
- Vulnerability scanners and SBOM tooling that echo the affected symbol or module path — suppressed by the package-ops filter.
- A one-off `python -c` coding-challenge snippet that defines `def solution():` and also shells out; rare, and requires all three conditions to coincide, hence report only.