LlamaIndex exec_utils safe_eval Sandbox-Escape RCE (CVE-2023-39662 Bypass)
LlamaIndex includes a function called safe_eval() meant to run limited Python expressions safely, blocking dangerous method calls. A known escape technique lets attacker-controlled text slip past that block and reach real code execution, letting an attacker run arbitrary commands on the host. This is a bypass of a previously patched vulnerability, CVE-2023-39662.
How the attack works
An attacker supplies malicious input, often via prompt injection, that is passed into LlamaIndex's exec_utils safe_eval() function. The input uses a chain of Python introspection tricks (things like __subclasses__, __globals__, __builtins__, __bases__, __mro__) to walk from a restricted object back to unrestricted built-in classes. From there it calls a real execution primitive such as os.system, subprocess, eval, exec, or __import__. The public proof-of-concept uses this chain to create a file on the target host, proving arbitrary code execution.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- b6f0a2e4-7c1d-4a9f-9e33-2f6d8c714aa0
- Severity
- Critical
- CVEs
- CVE-2023-39662
Why it matters
Successful exploitation gives an attacker arbitrary command execution on the machine running the LlamaIndex application, which can lead to full host compromise, data theft, or further lateral movement.
What you can do
- →Update llama_index to a version that fixes this safe_eval() bypass and confirm the patch actually rejects the gadget chain described here.
- →Do not treat safe_eval() or similar restricted-eval functions as a real sandbox; avoid evaluating any user- or LLM-influenced text as Python.
- →Review any LLM pipeline that feeds untrusted or model-generated text into eval-like functions and remove that path if possible.
- →If you must keep restricted eval in place, run it in an isolated process or container with no filesystem or network access, since method-blocklists are known to be bypassable.
Known benign look-alikes
- Regression test suites (pytest) that intentionally re-run the CVE-2023-39662 gadget payload to confirm the patched safe_eval() now rejects it
- Security scanners such as Bandit, Semgrep, or Nuclei whose command line embeds this exact gadget string as a static detection signature rather than executing it
- Python security-training or CTF material that spawns a process to demonstrate the __subclasses__/__globals__ sandbox-escape technique for educational purposes