LangChain PAL Math Prompt RCE Payload
LangChain versions up to 0.0.194 let an attacker turn a math or 'colored object' question into arbitrary Python code execution. The vulnerable PAL chains hand LLM-generated Python straight to eval() or exec() without checking it, so a crafted prompt can run OS commands or steal credentials.
How the attack works
An attacker sends a prompt to a LangChain app using PALChain.from_math_prompt() or PALChain.from_colored_object_prompt(). Because eval() only accepts expressions, the payload can't use a plain import statement, so it smuggles in the os module via tricks like __import__('os').system(...), getattr(__import__(...)), builtins lookups, or walking __class__.__subclasses__() to reach a usable class. The generated Python, containing this escape, gets evaluated by the app's interpreter, running the attacker's command. Detection looks for either the interpreter's command line carrying that eval-escape payload, or an outbound request body that contains both LangChain PAL/LLMMath markers (like 'def solution():' or numexpr.evaluate) and a command-execution or credential-harvesting primitive together.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c1f3a2e-9b64-4d1a-8f57-2c0b6ad91e34
- Severity
- High
- CVEs
- CVE-2023-29374
Why it matters
Successful exploitation gives an attacker arbitrary code execution on the host running the LangChain application, which can lead to full system compromise, data theft, or lateral movement.
What you can do
- →Upgrade LangChain past 0.0.194 or stop using PALChain.from_math_prompt() and from_colored_object_prompt() entirely.
- →Never pass LLM-generated code to eval() or exec(); if you must evaluate generated expressions, run them in a sandboxed, restricted interpreter with no access to __import__, __builtins__, or subclass introspection.
- →Treat any prompt or request body containing PAL/math-chain scaffolding plus __import__, os.system, or similar primitives as suspicious and log it for review.
- →Filter or reject inbound requests that combine LangChain chain markers with obvious command-execution syntax before they reach the model or interpreter.
Known benign look-alikes
- Security researchers or SOC analysts pasting the CVE-2023-29374 proof-of-concept into an agent session; suppressed when the CVE/GHSA identifier or advisory language is present in the same payload.
- LangChain's own unit tests (tests/unit_tests/chains/test_pal.py and similar) exercising PALValidation and the forbidden-import guardrails.
- DevOps and CI one-liners of the form python -c "__import__('os').system(...)"; rare but real, and the reason this rule reports rather than blocks.
- Dependency and container scanners emitting advisory text that quotes the vulnerable function names alongside the exploit snippet.
- Documentation, blog posts or training material about the vulnerability that an agent fetched and forwarded to an LLM endpoint.