Remote Code Execution in LangChain's JSONOutputParser via Crafted LLM Responses
Overview
A critical vulnerability was discovered in LangChain's `JSONOutputParser` component, allowing for remote code execution. The parser, when processing a malformed JSON string returned by an LLM, can be manipulated into invoking Python's `eval()` function on untrusted input. An attacker can achieve this by crafting a malicious prompt that is processed by an external document, webpage, or API. This causes the LLM to generate a specific payload string which, when the `JSONOutputParser` fails to parse it as standard JSON, triggers a fallback mechanism that insecurely uses `eval()`. This is particularly dangerous in agentic systems where the LLM interacts with external data sources that could be controlled by an attacker. For instance, an agent retrieving and summarizing a webpage could ingest a hidden payload that, when structured into what appears to be JSON by the LLM, exploits the parser to execute arbitrary Python code on the host machine. This bypasses typical sandboxing and can lead to complete system compromise, data exfiltration, or further network infiltration. The issue stems from insufficient input sanitization and the use of an unsafe deserialization method within the error-handling logic. The vulnerability was disclosed by security researchers at AI-Sec Labs during a routine audit of popular AI orchestration frameworks.
Affected Systems
Testing Guide
1. **Check LangChain Version**: Run `pip show langchain` in your terminal to check the installed version. If it is below `0.2.5`, you are vulnerable. 2. **Review Codebase**: Search your code for any instances of `from langchain.output_parsers import JSONOutputParser`. 3. **Create a Test Case**: Construct a test agent that uses `JSONOutputParser` and have it process a document containing a known malicious string, such as `{"action": "Final Answer", "action_input": "__import__('os').system('touch /tmp/pwned')"}`. If the file `/tmp/pwned` is created on the host system after the agent runs, the vulnerability is present and exploitable.
Mitigation Steps
1. **Upgrade Immediately**: Update the `langchain` library to version `0.2.5` or later by running `pip install --upgrade langchain`. 2. **Use Safer Parsers**: Replace `JSONOutputParser` with the more secure `JsonOutputParser` (note the case change) or `PydanticOutputParser` which do not have an `eval` fallback. 3. **Sanitize LLM Output**: Before parsing, sanitize and validate the output from the LLM to ensure it conforms to expected JSON structure and does not contain malicious payloads. 4. **Run in Isolated Environments**: Execute LangChain agents and applications in sandboxed environments (e.g., containers with restricted permissions) to limit the impact of a potential compromise.
Patch Details
Patched in LangChain version 0.2.5. The patch removes the `eval()` fallback mechanism in the parser.