Python eval RCE Payload Execution (SagemakerLLM complete Injection)
privateGPT's SagemakerLLM.complete() function takes the raw text response from an AWS SageMaker endpoint and runs it through Python's eval() to turn it into a dictionary. If an attacker controls or intercepts that endpoint response, they can embed Python code in it instead of a normal reply, and eval() will run that code inside the application.
How the attack works
An attacker with control over the SageMaker endpoint response, or the ability to intercept and modify it in transit, inserts Python source code into the text field instead of the expected completion output. The application calls eval() on that text expecting a dict, but eval() executes the embedded code directly in the host process. The injected code then spawns a child process — for example using __import__("os").system(...) or subprocess.Popen — to run OS commands, open a network connection, or drop a shell. The rule watches for the resulting spawned command line, either a self-contained os/subprocess import-and-execute pattern, or an eval/exec construct combined with a known execution or network sink (curl|sh, nc -e, /dev/tcp, etc.).
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- b7f3a1c2-9d4e-4a6b-8f01-3c5e7d2a9b64
- Severity
- High
Why it matters
An attacker who can influence the LLM endpoint's response gains arbitrary code execution inside the application process, which can lead to full host compromise, data theft, or lateral movement. Detection only sees the resulting child process, so the malicious code has already executed by the time this fires.
What you can do
- →Never call eval() or exec() on data returned from an external service; parse structured responses with json.loads() or a schema validator instead.
- →Restrict and authenticate network paths to SageMaker endpoints so responses cannot be tampered with in transit (TLS pinning, VPC endpoints, IAM policies).
- →Audit any code using SagemakerLLM.complete() or similar LLM wrapper functions for unsafe eval/exec parsing and patch or replace it.
- →Review alerts against known benign eval/exec use in packaging tools, static analyzers, and test runners before treating them as incidents.
Known benign look-alikes
- Python packaging shims that legitimately call exec(compile(...)) -- pip/setuptools legacy setup.py invocation, poetry/pdm/hatch build steps (suppressed by filter_tooling_*).
- Static analysis and secret scanners (bandit, semgrep, ruff, pylint, codeql, trufflehog) and grep/ripgrep searches for "eval(" or "__import__" across a source tree, where the searched pattern appears in the scanner command line (suppressed by filter_tooling_*).
- Test runners (pytest, tox, unittest) executing fixtures that exercise eval-handling code paths (suppressed by filter_tooling_*).
- Ansible AnsiballZ module wrappers, which exec a compiled module payload on the target host (suppressed by filter_tooling_*).
- Deliberate reproduction of this CVE by a red team or during patch validation on a lab host -- a genuine match; the rule only reports.