Symbolic Math RCE - sympify Eval Gadget in Spawned Process
A LangChain component meant to solve math expressions (LLMSymbolicMathChain) actually runs input through Python's eval() under the hood. An attacker who controls what text gets sent to it can smuggle in Python code disguised as a 'math expression' and get it executed on the server.
How the attack works
An application uses LangChain Experimental's symbolic math chain to let an AI agent evaluate math expressions. That chain passes attacker-influenced text to sympy's sympify() function, which internally calls eval(). An attacker submits a string like sympify("__import__('os').system('id')") instead of a real math expression. Sympy evaluates it as Python code rather than math, running the attacker's command with whatever privileges the agent process has. The detection looks for a single spawned command line that contains both a symbolic-math API name (sympify, parse_expr, LLMSymbolicMathChain, etc.) and a known Python code-execution gadget (__import__, os.system, subprocess.Popen, eval, and similar) — because both appearing together in one command is effectively the exploit payload itself.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7b1c4e2a-9d34-4f6b-a1c8-5e0f2d7b96c4
- Severity
- High
- CVEs
- CVE-2024-46946
Why it matters
Successful exploitation gives an attacker arbitrary code execution with the privileges of the AI agent process — potentially full server compromise, data theft, or lateral movement, depending on what that process can reach.
What you can do
- →Upgrade or stop using LangChain Experimental's LLMSymbolicMathChain (affected in versions 0.1.17-0.3.0) until a patched, hardened version is confirmed in use.
- →Never pass untrusted or user-supplied text directly into sympy.sympify() or similar eval-based parsers; use a restricted parser or sandbox with no access to __import__, os, or subprocess.
- →Review any application that lets an AI agent handle 'math expression' input from users and confirm it isn't backed by eval()-based evaluation.
- →Treat this as report-only: expect and filter out false positives from security testing, patch verification, or CTF/training activity before treating hits as real incidents.
Known benign look-alikes
- Security researchers or AppSec engineers reproducing CVE-2024-46946 with a proof-of-concept one-liner on a lab host.
- Patch-verification and regression harnesses that pass __import__ / os.system payloads to a hardened sympify wrapper to assert the payload is rejected - the payload string is then visible in the spawned command line.
- CTF, training or red-team-exercise environments demonstrating sympy eval escapes.
- Code-search or SAST tooling invoked with the gadget string as a literal argument (grep/rg/semgrep/bandit/codeql) - suppressed by filter_readonly_inspection.
- Package-manager invocations that merely name sympy or langchain-experimental - suppressed by filter_pkg_mgmt (they also lack a gadget token).
- Rare scientific one-liners that both parse a symbolic expression and shell out in the same command line.