# LangChain PAL Math Prompt RCE Payload

- **Severity:** High
- **Signature ID:** `7c1f3a2e-9b64-4d1a-8f57-2c0b6ad91e34`
- **CVEs:** CVE-2023-29374
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** LLM05 (Improper Output Handling)

## Summary

LangChain versions up to 0.0.194 let an attacker turn a math or 'colored object' question into arbitrary Python code execution. The vulnerable PAL chains hand LLM-generated Python straight to eval() or exec() without checking it, so a crafted prompt can run OS commands or steal credentials.

## How the attack works

An attacker sends a prompt to a LangChain app using PALChain.from_math_prompt() or PALChain.from_colored_object_prompt(). Because eval() only accepts expressions, the payload can't use a plain import statement, so it smuggles in the os module via tricks like __import__('os').system(...), getattr(__import__(...)), builtins lookups, or walking __class__.__subclasses__() to reach a usable class. The generated Python, containing this escape, gets evaluated by the app's interpreter, running the attacker's command. Detection looks for either the interpreter's command line carrying that eval-escape payload, or an outbound request body that contains both LangChain PAL/LLMMath markers (like 'def solution():' or numexpr.evaluate) and a command-execution or credential-harvesting primitive together.

## Why it matters

Successful exploitation gives an attacker arbitrary code execution on the host running the LangChain application, which can lead to full system compromise, data theft, or lateral movement.

## What you can do

- Upgrade LangChain past 0.0.194 or stop using PALChain.from_math_prompt() and from_colored_object_prompt() entirely.
- Never pass LLM-generated code to eval() or exec(); if you must evaluate generated expressions, run them in a sandboxed, restricted interpreter with no access to __import__, __builtins__, or subclass introspection.
- Treat any prompt or request body containing PAL/math-chain scaffolding plus __import__, os.system, or similar primitives as suspicious and log it for review.
- Filter or reject inbound requests that combine LangChain chain markers with obvious command-execution syntax before they reach the model or interpreter.

## Known benign look-alikes

- Security researchers or SOC analysts pasting the CVE-2023-29374 proof-of-concept into an agent session; suppressed when the CVE/GHSA identifier or advisory language is present in the same payload.
- LangChain's own unit tests (tests/unit_tests/chains/test_pal.py and similar) exercising PALValidation and the forbidden-import guardrails.
- DevOps and CI one-liners of the form python -c "__import__('os').system(...)"; rare but real, and the reason this rule reports rather than blocks.
- Dependency and container scanners emitting advisory text that quotes the vulnerable function names alongside the exploit snippet.
- Documentation, blog posts or training material about the vulnerability that an agent fetched and forwarded to an LLM endpoint.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2023-29374
- https://github.com/langchain-ai/langchain/issues/5872
- https://owasp.org/Top10/A03_2021-Injection/

---
Source: https://www.netzilo.com/threats/langchain-pal-math-prompt-rce