Remote Code Execution in LangChain's Experimental CodeInterpreter Tool via Deserialization
Overview
A critical remote code execution vulnerability was discovered in an experimental `CodeInterpreter` tool within the LangChain framework. This tool, designed to emulate the code execution capabilities of advanced AI models, utilized an insecure method for serializing and deserializing session state between turns. Researchers found that the tool used Python's `pickle` module to save the state of variables and execution history. An attacker could craft a malicious prompt that, when processed by an LLM integrated with the vulnerable tool, would generate a serialized `pickle` payload. When the `CodeInterpreter` tool attempted to deserialize this payload to restore the state for the next execution step, it would trigger arbitrary code execution with the permissions of the application process. This vulnerability is particularly dangerous in applications that expose LangChain agents to untrusted user input, such as public-facing chatbots or automated data analysis tools. A successful exploit could lead to a complete compromise of the host server, data exfiltration, or lateral movement within the hosting infrastructure. The root cause was the use of `pickle` on data that could be influenced by model output, which in turn was influenced by attacker-controlled input.
Affected Systems
Testing Guide
1. Check your project's dependencies for `langchain-experimental` and its version. If it is between `0.0.65` and `0.0.71`, you are vulnerable. 2. Review your LangChain agent definitions. If any agent is initialized with a `CodeInterpreter` tool, it is an active risk. 3. To test the exploit safely, create an agent with the tool and provide it a prompt designed to make the LLM output a known-safe pickle payload (e.g., one that prints a message to stdout). If the message is printed on the server, the vulnerability is confirmed.
Mitigation Steps
1. Immediately upgrade to `langchain-experimental` version `0.0.72` or later. 2. If upgrading is not possible, disable the `CodeInterpreter` tool in all LangChain agents. 3. Audit all agent tool configurations to ensure they do not use any tools that rely on insecure deserialization methods like `pickle`. 4. Replace any use of `pickle` for state management with a safe serialization format like JSON.
Patch Details
Patched in `langchain-experimental` version 0.0.72 by replacing `pickle` with a safer JSON-based serialization method.