Remote Code Execution in LangChain via Unsanitized Shell Tool Input from LLM
Overview
A critical vulnerability was identified in the popular AI framework LangChain, specifically affecting agents that utilize the `BashProcess` (Shell) tool. When an agent, such as one built on the ReAct (Reasoning and Acting) paradigm, is prompted to perform tasks involving shell commands, it relies on the LLM to generate the command string. This vulnerability arises because LangChain's default shell tool implementation directly executed the LLM-generated string without sufficient sanitization or sandboxing. An attacker could craft a malicious prompt (either directly or via indirect injection) that causes the LLM to output a command containing shell metacharacters. For example, a prompt like 'Analyze the file user_feedback.txt and then delete it' could be manipulated to produce the command `cat user_feedback.txt; rm -rf /`. The semicolon allows the attacker's payload to be appended and executed with the same privileges as the Python process running the LangChain agent. This allows for arbitrary command execution, leading to data theft, system takeover, or deployment of a reverse shell.
Affected Systems
Testing Guide
1. Create a simple LangChain agent that uses the `BashProcess` tool. 2. Provide the agent with a prompt designed to execute a secondary command, e.g., 'What is the current date? Then, list the files in the current directory using ls.' 3. In a vulnerable version, the agent's LLM might generate a command like `date; ls`. 4. If both commands execute, the system is vulnerable to command chaining and arbitrary code execution.
Mitigation Steps
1. **Upgrade LangChain:** Update to `langchain` version `0.1.20` or later, which introduces stricter validation and safe-guards. 2. **Use Sandboxed Environments:** Always run AI agents with shell access in isolated, minimal-privilege environments, such as Docker containers with no sensitive network access. 3. **Avoid Raw Shell Tools:** Prefer creating custom, specific tools that perform narrowly-defined actions (e.g., a tool to `list_files(directory)`) instead of a generic shell tool. 4. **Implement Human-in-the-Loop:** For critical actions, require human approval of the exact command generated by the LLM before execution.
Patch Details
The vulnerability is addressed in LangChain version 0.1.20 and all subsequent releases.